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Ms. So we will go on the record and commence at 10:04 a.m. 

This is a deposition of a witness who shall be identified throughout this deposition 
as "J. Doe," conducted by House Select Committee to Investigate the January 6th Attack 
on the United States Capitol pursuant to House Resolution 503. 

This will be a staff-led deposition. The members may choose to ask questions. 

If any of the members are present, | will note that they have entered, and I'll also note 
when they leave. _ If for at any reason at any time you want to check and see if a 
member is present, you can always just ask us, but their names will usually show up in the 
participants list. 

| know it looks like a lot of people are present. That's a number of people who 
monitor, report. And everybody on the right on the participants list currently is a 
member of the select committee or an official reporter. If you have any concerns or 
questions about who somebody is on the participants list, please don't hesitate to ask me, 
and we can identify them. 

My name ii and | am senior investigative counsel of the select 
committee. With me from the select committee staff ce 00|lUt~*~*Y professional 
staff member, and -- she'll be entering shortly = ££ for the reporters, 
that's -- and a number of select committee staff, who are on the 
right. I'll identify them if they come on screen and ask any questions. 

Under House deposition rules, neither committee members nor staff may discuss 
substance of your testimony today unless the committee approves its release. 

You will have the opportunity to review the transcript, if you want, in order to 
make corrections. 


But please note that, under House rules, you may have an attorney present but 
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counsel for other individuals may not be. Same with attorneys for other government 
agencies. At this time, I'd note for the record that you did not obtain counsel and that 
counsel is not present. 

| just want to go over some ground rules for the deposition. 

As you can see, there are individuals titled "Official Reporter," and they are 
transcribing our conversation. The reporters’ transcription will be the official record of 
the proceeding, and, as | mentioned, if you want, you'll have a chance to review that to 
make sure there's no errors. 

Please wait until each question is completed before you begin to respond, and 
we'll do our best to wait until your response is complete before we ask the next question. 
The reporter can't take down multiple people speaking at once, so it's really important 
that multiple people do not speak at the same time and we wait for each other to finish. 

The reporter also cannot note nonverbal responses, such as shaking or nodding 
your head, so it's important that you respond verbally to each question with an audible, 
verbal response. 

Please give complete answers to the best of your recollection. If a question is 
unclear, just ask me for clarification, and if you don't know the answer, please just say so. 
If a question doesn't make sense, it's likely because | didn't explain it well, so please don't 
hesitate to just ask me to clarify or rephrase or just say, "| don't understand what you're 
asking." 

You can refuse to answer a question but only to preserve a privilege recognized by 
the select committee. If you refuse to answer a question based on a privilege, we may 
proceed with the deposition or seek a ruling from the chairman on the objection. Ifthe 
chairman overrules the objection, you are required to answer the question. 


Finally, as we do for every witness who testifies before us, | will remind you that it 
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is unlawful to deliberately provide false information to Congress and doing so could result 
in criminal penalties, including charges under 18 U.S.C. 1001. And | reiterate, we give 
that warning to every single witness before us. 

The Witness. Okay. 

Ms. ae. Because this deposition is under oath, would you please raise your 
right hand to be sworn? 

The Witness. Yes. 

The Reporter. Do you solemnly declare and affirm under the penalty of perjury 
that the testimony you are about to give will be truth, the whole truth, and nothing but 
the truth? 

The Witness. | do. 

Ms. Okay. 

So, logistically, please let us know if you need any breaks, or if you'd like to take a 
recess to discuss anything off the record, we are happy to accommodate. | can't 
emphasize that enough. If you need a comfort break, if you need a pause, we are here 
on your timeline. So| don't want you to hesitate to just say if you need a recess; we can 
take a recess. 

As | mentioned before, members may come in. So there may be several people 
asking questions, between my colleagues here, my colleagues who are remote, anda 
member, should they appear in the deposition. 

And, again, if you don't understand a question, please just ask me to repeat it or 
clarify. 

Do you have any questions before we begin? 

The Witness. | donot. 


vs. Okay. All staff are present, so we'll continue. 


24 


25 


EXAMINATION 
BY MS. i: 

Q OnMay5, 2022, you received a subpoena, issued in your legal name, by the 
select committee, correct? 

A Correct. 

Q And that package included the subpoena itself, a cover letter from the 
chairman, a document schedule with production instructions, and a copy of the House 
rules and regulations regarding conducting depositions. 

Can you please confirm that you were the individual that was named in the 
subpoena that you received? 

A Yes, |am the named individual in that subpoena. 

Q_ And you understand that you're appearing here today pursuant to that 
subpoena, correct? 

A _ Yes, that's correct. 

Q The subpoena also required the production of documents described in the 
schedule attached to the subpoena. Understanding that you have left the company in 
reference, but did you have a chance to search for any documents in your personal 
possession that might be responsive to those requests? 

A | did search, and | didn't find anything. 

Q You did produce one document to us, though, correct? 

A The one thing | found was a screenshot of a text conversation between 
myself and my husband surrounding the events, yes, and | did produce that. 

Q Okay. And we'll discuss that later. The bigger issue was, we just wanted 
to put on the record that you had searched in response to those requests. 


A Yes. 
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Q So my goal today is to ask you questions relevant to the select committee's 
investigation, and if you have an objection or a privilege assertion, we'll ask that you 
assert it for the record. 

So, normally, we would ask that you provide your full name and a bunch of 
biographical information, but for security issues today, we're simply going to use the 
name "J. Doe." But it would be helpful if you could just explain to us your highest level 
of education. 

A | have a bachelor's degree, and | am working on a graduate certificate. 

Q Okay. And just out of curiosity, what is the graduate certificate in? 

A Cybersecurity. 

Q Okay. 

And can you take me through the last, let's say, 2 or 3 years of your work history? 

A Twoor3 years would make it 2019? 

Q Let's start with now. Let's start with where you work now. 

A Okay. Right now, | work for a small company that is an email service 
provider. And my role is in both product and people operations, so | am doing two jobs. 

Do you want me to explain more in terms of what those roles do? 

Q_ No, that's okay. We're going to focus on your prior employment. Can you 
tell me about the job before the one that you have now? 

A Yes. So, previously, | worked at Salesforce for almost 8 years. Inthat role, 
| managed ~— so that would mean that | handled anything related to spam 
complaints, block listings, high bounce rates. Anything that can go wrong with your 
email, it probably had crossed my desk. And that's specific to -- towards the end, it was 
Marketing Cloud and Pardot infrastructures. 


Q Okay. So let's start in the relevant time period. What was your title and 
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position in 2020, at the beginning of 2020? 


A | ws as 


team. 


Pp 


Okay. And did that role change at any point in 2020? 


> 


In 2020, it did not. 

Q Okay. And I'm sorry, could you say that title one more time? 

Now, | had multiple titles. That was the external title. Internally they called me 
all kinds of stuff; it was privacy compliance, email compliance, anti-spam, anti-abuse. 
It's all the same thing, essentially. 

Q_ Andso, just to be clear, was your position the same in 2020 and leading up 
until 2021? 

A Yes. 


Q Okay. So, during the entire relevant time period, you had the same title at 


Salesforce. 
A | did. 
Q Okay. 


And | think you said it a moment ago, but was there a division within Salesforce in 
which you worked? 

A Hang on. Let me -- can | -- am | allowed to verify -- or can | go off the 
record and ask a question? 

Ms... §9=We_can take a recess, absolutely. We'll take a brief recess and go off 
the record. 

[Discussion off the record. ] 


Ms i. So we'll come back from recess, and we'll go back on the record at 


1 10:14. 


2 By Ms ie: 


3 Q  So,a moment ago, we were talking about your position in 2020, and | think 


4 you wanted to clarify what your roles were during the relevant time period. 


6 February 2020, and then | was made _-———" 


7 Q Okay. And 1 think -- 
8 A So -- 
9 Q  Goahead. 
10 A That was a title change, but nothing really changed in terms of my role. 
11 Q Did your salary change? 
12 A | think a little bit. 
13 Q | guess amore important question: Did you consider it a promotion? 
14 A Um, yeah. 
15 Q Okay. 
16 A It was one of those, like, yes and no. Like, | was already doing the work, 
17 and -- you know, it was one of those promotions. 
18 Q_ That's fair. Promoted to what you were already doing. 
19 A _ Right. 
20 Q  So,amoment ago, before the recess, | think you said you were working 


21 within a division called Marketing Cloud. 


22 A That's correct. 
23 Q  Andcan you explain what Marketing Cloud does? 
24 A Yes. So Marketing Cloud is owned by Salesforce. | guess you could call it 


25 a division or an organization as part of Salesforce. Because it's a bit of a weird setup, | 


16 


17 


18 


19 


20 


21 


22 


23 


24 
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think, in that Marketing Cloud has a CEO but then Salesforce also has a CEO. Salesforce 
was my first corporate job, so I'm not sure if that's common across the board. 

But, anyway, Marketing Cloud is an email service provider. So they have clients; 
those clients will send emails to subscribers, and that's any email addresses on their lists. 

Q Anda moment ago you said Marketing Cloud had its own CEO. Do you 
happen to remember who that was during 2020 into 2021? 

A | believe -- so we changed CEOs around that timeframe. Originally, it was 
Adam Blitzer, and | don't know who the next CEO was. | know, fora while, there was 
some upheaval where it was kind of unclear. 

Q And|think a moment ago you said you were in a unit, and | caught "abuse" 
and "compliance." Is that the title? 

A _ That is correct. 


Q Okay. 


> 


The -- 

Q  Andcan you -- go ahead. 

A The naming of the teams was very loose. You know, it was, as | said, 
Salesforce privacy and abuse management, it was anti-abuse and privacy, it was -- we just 
kept renaming, and we never actually settled on a real name. 

Q What was the name in 2020 that you remember? 

A We called ourselves Salesforce privacy and abuse management. 

Q Okay. And did that change at some point in late 2020 or 2021? 

A It was so fluid. Like, it was never set in stone. So we might've called 
ourselves that. Mickey might've called us something else to some otherteam. We 
never truly formalized on what the team name was. We knew what we did; we just 


didn't know what to call ourselves. 
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Q Okay. And think between the titles, privacy and abuse management or 
abuse and compliance, it seems abuse was consistent in the titles. 

A It was, yes. That was the one thing we -- yeah, naming-wise, that was the 
only consistent thing. 

Q And while you were there in 2020 -- and just so | can be clear for the record 
and just so that we don't keep saying it, I'm going to say "the relevant time period," and 
that's going to be, we'll say, mid-2020 through March 2021. 

A Okay. 

Q Okay? So, if anything changes during that time, just let me know, but we're 
really just focusing on mid-2020 through early 2021. 

So can you tell me who worked with you in your unit, whether it was privacy and 
abuse management or abuse and compliance? Did you have a pod or a group of people 
that you worked with? 

A | did, yes. Sol managed two individuals. Should | name them? 

Q  Youcan. 

A Okay. Sol managed [il who was a full-time employee, and who 
was a contractor. —— managed the Pardot side of the infrastructure. J 
managed the ExactTarget/Marketing Cloud side of the infrastructure. Then | reported 
up to 

Q Okay. 

A Do you want me to take the whole chain? 

Q We're going to come back to that, so let's pause for a moment. 

Can you just explain -- you said ll handled Pardot. What is Pardot? 

A Pardot was originally how | came into Salesforce. So Pardot was bought in 


2013 by ExactTarget. ExactTarget got bought by Salesforce. Salesforce renamed 
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ExactTarget to Marketing Cloud. And that was how | came in. 

So we still had two separate products. There was the Pardot product, which was 
mostly business to business, or B2B, and there was Marketing Cloud/ExactTarget, which is 
B2C, business to consumer. 

Q Okay. And would there be any way to know the difference between 
ExactTarget and Salesforce functionally for the rest of the world? 

A In terms of what? In terms of what product you're using or -- 

Q_ So is ExactTarget the name of a product that Salesforce sells? 

It's called Marketing Cloud now, but, yes, you could buy pieces of Marketing 
Cloud. 

Q Okay. 

A _ Their infrastructure was a little weird, | think, in that you could buy certain 
pieces that were Marketing Cloud, like Audience Builder, Journey Builder. But, yes, they 
were different products. 

Q Okay. 

A But for Pardot you would just pay for Pardot, and that was the product. 

Q_ And just to be clear, are you saying that ifhandled abuse and compliance 
for Pardot and handled abuse and compliance for ExactTarget? 


A Yes, that's correct. 


Q Okay. And then you supervisedffililg] and "| 


A Yes, 
Q And you reported up to | 
A  ldid. 
Okay. Andis ae: at Salesforce? 


> Pp 


He is not. 
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Do you know when he left? 

| believe it was this December. 

December 2021? 

Yes. Um-- yes, because we're in 2022. Yes. 


And understanding these are ballparks to the best of your recollection, so, 


you know, if you're wrong -- but we're just asking for your best memory, understanding 


these are other people's employment dates. 


Do you happen to know if is still at Salesforce? 


A 


Q 


> Pp 


> YP 


She is not. 

When did she leave, to your best recollection? 

She left in August. 

Of 2021? 

Yes -- sorry, of 2022 -- 2021. 

2021? 

Yes. It was this most recent August, so, yes, 2021. 


And what about | 


== because he was a contractor, had to leave in end of May, early, early 


June of 2021. 


Q 


Okay. And so everybody who worked in the abuse and compliance 


department during the relevant time period is no longer at Salesforce. Is that right? 


A 


Q 


> Pp 


That is correct. 

And, to the best of your knowledge, have they replaced any of you? 
They've replaced one of us -- well, and the contractor, so | guess two. 
But not all four of you. 


No. 
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Q Okay. 
And the contractor never really got trained, so | don't believe he's quite up 
to speed. 


Q_ And, to the best of your knowledge, do you know why left 


Salesforce? 

A Because of what happened with 

Q. Andcan you explain that? 

I can. 

So Salesforce has a policy in which, if you hire a contractor, they can only be a 
contractor for 2 years. 

Canl pause? Canlgooffthe record? Should | -- 

Ms. Wait, wait. 

We're going to take a brief recess at 10:22 a.m. and go off the record. 

[Discussion off the record.] 

Ms. So we're going to come back from recess at 10:23, and we're back on 
the record. 


BY Ms aa: 


Q_ And| believe the question right before we left, you had said something 
about that (i ad left Salesforce because of an incident with i Can 
you explain that? 

A Yes. 

So Salesforce had a policy that contractors could only be hired for 2 years. 
Otherwise, they had to go FTE -- that's full-time employment -- or they had to leave. 

Which, for the abuse desk, is, frankly, absolutely ridiculous because it is a very, 


very specialized role. It takes alot of training. It takes a certain person to be able to 
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manage the abuse desk. As you can imagine, there's a lot of stuff that gets thrown at us 
that's pretty nasty. 

So we would hire this person for 2 years, put all that energy into training them, 
and then they had to leave. 

So, with i we wanted to hire him FTE -- so that's, again, full-time -- because 
he had the skills, he was very good at his job. And for Marketing Cloud, it's insane that 
you would have to keep retraining someone every 2 years to manage the entire 
Marketing Cloud infrastructure of all of their customers. 

So we were inthis process. | kept saying -- trying to be aggressive it with it, 
saying, "Hey, what's going on? What's with the paperwork," yada, yada, for the last 
6 months. | kept getting, you know, the sort of pat-pat, don't you worry, it'll 
be handled by all the il who are older and more experienced than you. So | was like, 
all right, fine, okay, | guess we'll go from there. 

End of May, it got to his last week -- I'm sorry -- second-to-last week, and | finally 
got, "Okay, you can have the headcount." | said, okay, this is great. We're going to 
start working on salary, you know, kind of, all the paperwork stuff you do with HR. 

We're in the middle of that email thread, and «ss: boss -- so that would 
be a. messaged and said, "Oh, I'm so sorry, we actually don't have that 
headcount. We've got to figure something else out." 

So their solution -- and air quotes, "solution" -- to this was, just have another 
contracting company hire | try and get around this 2-year restriction. 

The other contracting company looked at TB csume and said, "Oh, he'd be 
a great employee for us. We would like to maybe hire him instead," to which we said, 
"That was never on the table. We'd like you to hire him and have him be our 


contractor." Then they effectively ghosted us, allegedly. 


24 


25 


16 


And then Ts last week BBE decides to go move his house, and so he's 


completely out of office. | am left pretty much holding the bag, just trying to scramble 
and figure out what is going on with a's employment. 

| message Tim, who is Mickey's boss, and ask, "What is going on?" That's fill 

| og and say, "What is going on?" BB says to me, "Oh, I'm not really sure, but if 
Forrest wanted to find another job," basically, "we wouldn't take it personally." 

Which you don't do to somebody. You don't say you have -- it was just sucha 
disaster. And it was all -- and then everybody started blaming everybody. It was, 
BE banca andi eb a oy | blamed all of them. 

So then we just realized that Salesforce didn't care about anti-abuse, they didn't 
care about our team, they weren't investing in any of us, and we were going to leave. 

Q Was the incident withthe only thing that gave you and your team 
the impression that Salesforce didn't care about abuse? 

A No. 

Q What other incidents or events gave you that concern? 

A So there was the fact that -- let me back up and say, any reputable email 
service provider will publish an "abuse@" address, so that if you get unsolicited mail from 
SendGrid, from Pardot, from Marketing Cloud, you would have an abuse@ -- so 
abuse@Pardot, abuse@MarketingCloud, abuse@SendGrid, whatever it is. 

Salesforce did publish an abuse@, so you could email abuse@Salesforce, but, to 
our knowledge, they didn't actually have an abuse team managing those requests. 

| was told in, | think it was July 2017 or 2018, that Salesforce had, quote/unquote, 
"discovered" the abuse inbox, like, discovered that they had it, and they were going to 
manage, like, five cases a week maybe. And, as you can imagine, at the scale of 


Salesforce's infrastructure, | have a hard time believing they only received five cases a 
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week. 

So that was kind of an indication, that they had, quote/unquote, "discovered" 
their own abuse inbox. So, clearly, they didn't care terribly much. 

And then -- 

Q Let me come back to the abuse@ address box and those issues. 


You mentioned earlier, and | just want to clarify, the reporting structure. | think 


you said BE cported up to an individual named IP 


A Yes. 
Q  Andthat's SP 
A Yes. 


Q = Anddo you know what his title was? 
A 


| do not. 


Q- And|think you said Bl eported up to somebody named in 


A _ That's correct. 

Q  Anddo you know what [is title -- excuse me. Do you know what a: 
title was? 

A His changed, but | think he was a VP or an SVP of something. 

Q Okay. And both of those individuals, to your knowledge, are still at 
Salesforce? 

A Yes, 


Q 9 Okay. 


And [aoe a he reported up to somebody named, | believe? 
J \s. iy: 


Q_ [have no idea how to spell that, so we'll just say common spelling and look it 
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And then do you know who fT ec ported up to? 


A 


Q 


A 


| believe he reported to Adam Blitzer, but I'm not confident of that answer. 
Okay. And do you know who Blitzer would've reported up to? 


| also believe Blitzer would've reported to Bret Taylor, but it's possible there 


was a layer in there that | wasn't aware of. 


Q 
A 
Q 


A 


> 9p > fp 


> YP 


Q 


And do you remember Mr. Taylor's title? 
Something C-level. 

And do you know who Mr. Taylor reported to? 
Marc Benioff. 

And what is Mr. -- I'm sorry, is it B-e-n-i-o-f-f? 
Yes. 

And it's Marc with a C, isn't it? 

Yeah, it is. 

And do you know his title or role? 

He's CEO of Salesforce. 

Of all of Salesforce. 

All of Salesforce. 


Okay. 


So there were approximately six levels above 0 the CEO, Marc 


Benioff, give or take? 


A 


Q 


Yeah, I'd say six-ish. 
Okay. 


Six or seven or eight. But, yeah, it was not that many. 


Now, earlier -- | want to go back -- you said your role was ie ot 
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some point in February of 2020 -- as of February 2020, you were of 


privacy and abuse management. But | think earlier we talked about that i 
may have used a different title instead, abuse and compliance. 

Can you explain the difference between abuse versus compliance? 

A They're kind of the same. | mean, for us, they were sort of the same thing. 
| know in different industries compliance means something totally different; it's 
compliance with the law. For us, if you were abusing the system, you were not in 
compliance with our policies. And | -- 

Q Okay. 

A And | want to put a lot of emphasis on the word "policies" there. 

Q_ Andis that because, to your point earlier, normally when people say 
"compliance," to your point, it's usually with some kind of regulation or statute or an 
outside obligation, but it sounds like what you were saying was that "compliance" meant 
with your corporate policies, which could be something like acceptable use practices or 
agreements between Salesforce and its customers? 

A Yes, that's exactly it. So, for us, it was compliance with the MSA and with 
the -- sorry -- Master Subscription Agreement and with the permission-based marketing 
policy on the Pardot side, the anti-spam policy on the Marketing Cloud side. 

Q_ And it sounds like you've been in the email industry for quite a while. How 
many years have you been doing this? 

A Eight years. 

Q Okay. 

And can you explain, why do -- let me go back fora second. When we're talking 
about abuse, who are we talking about either being abused or doing the abuse? 


A Doing the abuse, in our perspective, would be our customers. Being 
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abused would be our infrastructure -- and, in a way, like, their customers, because they're 
getting unsolicited email. 

Q So that's what | kind of wanted to parse into, is, when you say you're abused, 
I'm assuming you're getting complaints. 

A Yes. 

Q And those complaints are presumably from the recipients of emails that are 
coming from your platform. 

A Yes. 

Q__ So, if acustomer was using Marketing Cloud and they were sending out 
millions of emails and there were complaints from the people who were receiving those 
emails, some of those people might actually come complaining to you, the platform they 
were getting the email from. 

A Yes. That's correct. 

Q Okay. 

Why do those complaints matter if those individuals aren't your customers? 

A So that touches on the overall email industry. So we have the CAN-SPAM 
Act of 2003, which has seven provisions, none of which include that you have to have 
opt-in permission. So there is a joke in the industry that is: You can spam. 

But if you want your mail delivered, you have to have permission. And that is 
Yahoo, Gmail, that is the inbox providers of the world saying, "We are not going to deliver 
your mail if it is not wanted by our customers." 

So any reputable service provider will publish and enforce a permission policy of 
some sort -- permission-based marketing policy, anti-spam policy, AUP. Whatever it is, 
we do not allow spam on the platform. 


So, in order to abide by those requirements of the industry, we have to actually 
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enforce said policies. 

Q And just to be clear, earlier | think you used the term "MSA." You said it 
was a Master Subscription Agreement. This is the contract that Marketing Cloud would 
have with its customers in terms of the terms by which the customer would have to abide 
by? 

A Yes, that's correct. 


And | think there's a term "AUP." What does that stand for? 


p 


> 


Acceptable use policy. 

Q Okay. And is that practices that customers would have to follow? 

A Yes. So we didn't use "AUP" as a term, but AUP would generally cover how 
you're allowed to use the services. So| know Marketo called it an AUP, but it was 
effectively, like, "Don't send spam, and here's what spam is," et cetera. 

Q What do you call it -- or what did you call it at Salesforce? 

A For Pardot, it was the permission-based marketing policy. For Marketing 
Cloud, it was the anti-spam policy. And the reason they were differently named is 
because we were different companies to begin with and we hadn't merged the policies. 
Effectively the same thing but just different names. 

Q Okay. All right. 

And | think a moment ago you covered this, but | just wanted to make sure | 
understand this, because we're obviously not email experts. But Salesforce is an email 
service provider, an ESP? 

A Salesforce as a whole is a lot more than just an ESP. 

Q_ That's fair. But Marketing Cloud, would that qualify as an ESP? 

A Yes, it would. 


Q Anda moment ago! think you mentioned Google, Yahoo. Those are ISPs, 
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inbox service providers? 

A That's correct. 

Q Okay. 

And if | understood you correctly, those companies are very concerned with how 
much spam gets through to their customers, because if their spam filters don't work, they 
might go to another company, right? 

A Yes. 

| also want to make a point on the language. 

Q Okay. 

A The ISPs, we also can use that interchangeably with senders and receivers. 
So a sender is an ESP; a receiver is an ISP. Sometimes it just helps us clarify the 
language, because "ISP" could also mean internet service provider, and that confuses 
people. 

Q_ Yes, itdoes. So that's why! wanted to get the terms correct just in case we 
started saying ISP, ESP. 

But that's also super-helpful, to know that Salesforce could be -- or Marketing 
Cloud -- we'll just say Salesforce -- Salesforce could be the sender and Google could be 
the receiver or the ISPs would be the receivers. 

A Yes. 

Q Okay. Because Salesforce would be sending emails that would go through 
the infrastructure and platforms of those inbox service providers, correct? 

A __ That is correct. 

Q Okay. 

Now, can you explain what Spamhaus is? 


A Yes. So Spamhaus is the biggest, most reliable blocklist provider that we 
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have in the industry. 

Q_ And let me just clarify for the reporters, it's Soamhaus, h-a-u-s. 

And can you tell me -- a moment ago, you said it's the -- I'm sorry, say it one more 
time. It was a blocklist provider? 

A Yes. 

Q = And what does that mean? 

A So let me start with language. It used to be called "blacklist." We 
changed the terminology to "blocklist.". So you may see those used interchangeably 
across the internet. Weare trying to change the language to "blocklist." 

But what Spamhaus does is, they run networks of inboxes, essentially, that just 
look at what mail is being received. Depending on what they see, they may list an IP 
address. So that's a list that, when a receiving server gets an email, it'll say, "Okay, can 
this sending IP address be trusted? Is itagood IP address? I'm going to go check and 
see if it's on a blocklist anywhere. _ If it is, I'm going to treat it a certain way." 

So, because Spamhaus is the biggest, most trusted blocklist we have, if you are 
listed on Spamhaus, fully 60 to 80 percent of your mail is probably going to get hard 
bounced. 

Q And when you say -- you're talking about the sender, right, not an individual 
email address who says, "Oh, | want to be included on your list"? You're saying 
Spamhaus actually blocks entire senders for bad practices? 

A They have the right to. You would have to be a very, very bad sender for a 
very long time -- maybe not a very long time, but you'd have to be a very bad sender for 
them to block your entire IP space. Generally Spamhaus will list a single IP. 

Q Okay. 


So | guess my questionis: I'm anindividual. Dol write Soamhaus and say, can 
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you put my email on a list so that nobody sends it? Or is it more for companies to use? 

A lsee. Okay. First of all, you can't write in to Soamhaus and request 
anything. Spamhaus does their own thing. But it's not email-address-based. So it's 
IP-based. 

Q Okay. 

So is it fair to say they do some kind of assessment on the deliverability of emails 
based on, like, an evaluation of the performance of an IP, like, how well they're doing in 
terms of spam rates? 

A No, that wouldn't be accurate. Spamhaus -- 

Q_ That's okay. _ It felt like word salad when it came out, so I'm glad you 
corrected it. 

So, like, you tell me in your knowledgeable words, what is it that Spamhaus is 
doing? Like, what is the service that it provides to the industry? 


A Okay. So there are these email addresses that are known as spam traps. 


Pp 


They're known as what? 


> 


Spam traps. 

Q Spam traps. 

A These are addresses that -- and so there's different types of spam traps. 
There's pristine traps, there's recycled traps, and there are typo traps. 

A pristine trap is an email address that never gets published to the internet. It 
just is an email address that exists. 

A recycled trap is one where | might have purchased a domain, | will bounce mail 
from that domain for roughly 12 to 18 months, and then | will recycle whatever addresses 
were on that domain. They are now a recycled trap. 


Then there's typo traps. Sol might buy Gamil.com, Gmaill.com, common 


25 


misspellings of known domains, known email domains. 

Spamhaus has some combination of traps -- they keep things very, very locked 
down, very, very secret, but they have some combination of these traps to know, hey, if 
someone is hitting a pristine trap that has never been published anywhere by anybody, 
how did they get that address? They clearly got it through means that were not opt-in. 

So they know, based on those trap hits, that you're doing something you shouldn't 
be doing. You're buying lists, you're guessing addresses, you're appending -- you're 
doing something wrong. Based on that data, they will list an IP address. 

And that -- and let me clarify. That is specific to the SBL. They run multiple 
lists. So they may see something like from, | don't know, some gambling ring or 
something, and that's somewhere else. But the list | specifically focused on was the SBL. 

Q And what does the "SBL" stand for? 

A Spamhaus Block List, | believe? 


Q Okay. Allright. And we'll drill down into some of the things that you just 


said. 

| want to cover, when did you leave Salesforce? 

A | left in August of 2021. 

Q And why did you leave? 

A | left because of | left because Salesforce very obviously didn't care 
about anti-abuse. | left because | was crying at my desk every afternoon right around 


2:30, and | deserved better. Salesforce had burned me out. 

Q Anda moment ago! think you said that -- we were talking about the abuse@ 
address, and you were talking about that lack of culture. 

Understanding now that that's part of why you left -- 


A Uh-huh. 
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Q- --can you go back to explaining that abuse@ address? | think you said 
something to the effect of, that would've been something that would be published 
somewhere that somebody could find but nobody was on the other side at Salesforce? 

A Yes. What was the question? 

Q Well, | guess what I'm trying to figure out is, you had an abuse department. 
Were you ever able to determine why the abuse at Salesforce wasn't being forwarded to 
the abuse department? 

A There's a couple reasons. And that's a very good question. 

To start off, Salesforce proper -- so |'m talking core, the core CRM product -- did 
not have a permission requirement. Salesforce's core product just said, whatever law 
you need to comply with, you should go ahead and maybe probably comply with that. 

The law in the U.S. is CAN-SPAM. CAN-SPAM, again, has nothing to do with 
opt-ins. So you can completely send spam that is CAN-SPAM-compliant. 

So, even if we did take those complaints, there's nothing we would've really been 
able todo with them. We could've opted that person out, sure, but there wasn't really 
an ability to, like, kick people off the platform or really enforce anything. 

Q Well, when you say kick people off the platform or enforce anything, you're 
talking about kicking them off the Marketing Cloud platform or enforcing your MSA and 
acceptable use policies, right? 

A No. For Salesforce -- this is where it gets confusing, right, is, there's 
multiple contacts, there's multiple layers to this. 

Salesforce core did not include a permission requirement in the MSA. So you 
could feasibly sign up for Salesforce CRM services, you could send -- | think they had, like, 


you could send 200 emails a day or something. But don't quote me onthe 200. That's 
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not exact. But you could just send whatever mail you wanted to out of Salesforce 
proper. They had their own infrastructure for that. 

Then you have Marketing Cloud, which does have a permission policy, does have 
those requirements, has a separate infrastructure than what Salesforce core has. 

Pardot was the same way. Wehada permission-based marketing policy. We 
actually used Marketing Cloud's infrastructure, so -- when | say infrastructure, | mean 
servers, kind of all that technical setup -- and we used their infrastructure, so we 
published the policy. 

The Salesforce core did none of that. 

Q = Anddo you think that's partially because, it sounds like, Pardot and 
ExactTarget or the products that Marketing Cloud was using to send emails allows for 
thousands, possibly millions, of emails to be sent per day? 

A Thatiscorrect. Because of the scale, yes, we definitely had to comply. 

Q_ Andso, earlier, when you said the abuse@ address, that was an 
abuse@Salesforce for all of Salesforce core? 

A So it got a little weird there. We had abuse@Salesforce that existed. 
Nobody really knew it existed, or was paying attention, rather. 

There was a guy who managed email deliverability in Marketing Cloud. His name 
was He is no longer there. But went and said, okay, hey, there's 
the abuse@Salesforce address. I'm going to write -- he wrote some sort of script that 
would actually look in the abuse inbox -- I'm sorry -- the abuse@Salesforce inbox, and if 
he saw anything related to Marketing Cloud, he would actually forward it on to my team. 

Q = And when do you think J discovered and did that? What is the 
timeframe you're talking about that that happened? Before 2020? 


A It would've been before 2020, yes. 
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Q Okay. And so, during the relevant time period that we are talking about, 
that already existed. 

A Yes. To my knowledge, yes. 

Q_ So, while you were there during the relevant time period, emails that were 
sent to abuse@Salesforce that referenced Marketing Cloud would've been 
auto-forwarded to your team. 

A Yes, if there was a way to tell that it was from Marketing Cloud. 


Q_ Right. 


> 


Should | explain how you can tell? 
Q Yes. That would be helpful. 
A Okay. 

The way you can tell if it's sent from Marketing Cloud is if you receive the email 
headers. Email headers are the information -- basically all of the technical information 
on how an email got from point A, the sending server, to point B, the receiving sender. 

So, if you included headers, we had a line in there that was called the X_job. The 
X_job would tell you the account name and the job the actual server ran. If the X_job 
was included -- that was a specific header line just for Marketing Cloud. If the X_job was 
included, we knew it was a Marketing Cloud account. 

Q_ Soif|I'ma recipient of an email that | am sitting here saying "I didn't sign up 
for this" or "I'm having problems," | could look at that header and theoretically figure out 
exactly which company sent it to me, complain to that company, the ESP; and if | was able 
to find the email address, in this case similar to abuse@Salesforce, get my complaint to 
somebody who could then check the header of my email and say, yes, this did indeed 
come from us. 


And if I'm understanding you correctly, not only could you confirm that it came 
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from Salesforce, you could actually confirm that it came from the Marketing Cloud, and 
you could even confirm which customer on Marketing Cloud that it came from. 

A Yes. Solcoulddothat. So, for you, if you are a more -- and you have to 
be more technical to understand headers exist. 

But let's say you are a more technical user. You go into your inbox; you read 
headers. You wouldn't know from the X_job that Marketing Cloud had sentit. You 
would know because we have an X report of the X-report-abuse. And the 
X-report-abuse would say, oh, it's abuse@ -- | think we were using ExactTarget.com at the 
time. And so you could just go email that address. 

You could also know based on the IP address. So you would say, okay, here's the 
IP address that actually sent the mail, I'm going to go look up that sending IP address, I'm 
going to figure out what infrastructure sent this mail, and I'm going to go complain to 
their abuse address. 

Q_ That's very helpful. 

So | want to turn really quickly and ask if you remember dealing with a customer 
at Marketing Cloud called the Republican National Committee, or the RNC. 

A | do. 

Q And was it your understanding that -- well, let me back up for a second. 

The account name was the RNC, but was it your understanding that they may have been 
doing work for other entities? 

A Can you define "other entities"? 

Q Yeah. So, to the best of your knowledge, do you know if the Trump 
campaign was working with the RNC and using the RNC's account at Salesforce? If you 
know. 


A | don't know. 
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Q Okay. 

A What | do know is they sent a lot of mail purporting to be from the Trump 
campaign. 

Q Okay. So, if you were looking at the content of the emails that were being 
sent from the RNC campaign -- excuse me -- from the RNC Salesforce account, you would 
think a number of them were being sent from the Trump campaign? 

A Yes. 

Q Okay. 

And when do you remember first coming to deal with the RNC as a customer at 
Marketing Cloud? 

A Asawhole, it would've been early on. It would've been early 2020. 

Q Okay. And do you remember having issues or problems, from an abuse 
standpoint, with RNC as a customer? 

A Yes. 

Q What's the earliest you remember dealing with abuse problems with the 
RNC? 

A The earliest, sort of, trickles of abuse would've been early 2020. The 
deluge of abuse would've started in June-ish. 

Q  Andcan you explain what you mean, "the deluge of abuse"? Day-luge? 
Dell-yuge? 

A The tsunami, we'll just call it. 

Q  Thetsunami of abuse. There we go. 

A Yes. So, because of how many cases we see at the abuse desk, it takes a lot 
for you to really ping my radar. You have to be pretty up there, in terms of something 


you're doing -- spamming, Spamhaus, whatever it is -- for me to really take notice. 
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So, in June, the RNC started really having me take notice. Sothey had quite a 
few complaints, quite a few issues. 

Q Okay. And I'm going to come back to what types of complaints, so let's just 
put a pin in that for right now. 

What happened -- do you take any action when you see the tsunami of complaints 
coming in June? 

A So let me back up, because this is sort of relevant. 

Back -- and | want to say it was in April -- we had a complaint with the RNC. _ It 
was kind of a one-off. We managed it. They gave us kind of a -- not a real answer, but 
| can't go after people -- even though you can have the sense they're doing -- you can tell 
they're doing something wrong, you can't feasibly go after them. 

But in, | want to say it was April, said to me, "| want to manage 
all" s vous to manage all of the RNC's complaints. So, when | started seeing 
these come across my desk, | would read them, | would verify it was the RNC, and | would 
send it up to 

Q__ | just want to clarify, when you say that happened in about April, i 
a: that he wanted to start handling the communications with the RNC 
regarding their complaints, but you were still going to conduct the investigations into the 
complaints? 

A Lightly. And when | say "lightly," | mean | would verify that it was the RNC, 
myself and =| would verify they had been unsubscribed, and then we would send it 
| 

| say "lightly" because part of an investigation involves going to the customer, in 
this case the RNC, and saying, "Hey, where did you get this information? How did you 


get it? Who authorized you getting it?" So you may respond with, okay, it was a form 
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fill on February 15th, and, obviously, the customer had given me -- this person had given 
me permission to send mail. That was the other half of the investigation that I 
was supposed to be doing. 

Q Andafter P| said he would take over doing it in April 2020, do you 
know if he ever, in fact, had any of those conversations with the RNC? 

A | don't believe he did, but | -- 

Q Okay. 

-- can't -- you know, that's to my recollection. 

Q_ And before he took over in April 2020, did you ever have conversations with 
anyone at the RNC about the complaints? 

A | remember having one. 

Q Do you remember the individual you spoke with? 

A |donot. It was some very generic male name. 

Q Okay. And did you speak with him in person, or was it on the phone? 

A 


No. Everything we did was via email. 


Q_ Everything was via email. 

A Everything. 

Q Okay. 

A It was exceedingly rare that | would get on the phone, because we knew that 


abuse cases could be used in, like, legal proceedings and people could sue, et cetera. So 
we tried to keep as much as humanly possible in writing. And | was very, very intense 
about that with my team. 

Q Interesting. Okay. 

And in the emails when you would raise issues with the RNC -- | think you said you 


did it once -- what was the tone of their response when you raised a complaint issue with 
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them? 

A From what | recall, it was fairly indignant, that they couldn't believe we 
would dare reach out. That's to the best of my knowledge, is that they reacted as if, 
like, you shouldn't be doing this, how dare you. 

Q_ Andearlier, a while ago, you said something about bounce rates, | think, was 
something that you looked at. Did the RNC have high bounce rates? 

A So, for the Marketing Cloud, they didn't really -- we didn't monitor bounce 
rates. On Pardot side, we did for a couple of years. We hada job that would run that 
would actually monitor for client bounce rates. But Marketing Cloud didn't. Marketing 
Cloud was entirely complaint- and blocklisting-based. 

Q Okay. 

And so earlier, a moment ago, you said that in April 2020, this is when aa 
TE takes over the communication side of the relationship, and then in June 2020 
there's a tsunami of complaints. 

Now, do you go to Mr. Chandler at some point to try to change the relationship 
between you and the RNC? 

A In away, yes. | actually went to ——— and said, "Look, given what's going 
on politically and given what I'm seeing, | do not feel comfortable remediating any issues 
they have. So, if they were to be listed by Spamhaus, | would like to recuse myself." 

Should | -- 

Q Yeah. Can you explain what that means? 

A Yes. So my job was to manage the -- any time a client got listed by 
Spamhaus, it was my domain. | would manage the Spamhaus listing. If the RNC got 
listed, | was not going to offer remediation. | was going to let to handle it. 


Q  Andwhen you say "remediation," you mean help getting the customer, RNC, 
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out of trouble with Spamhaus? 

A That is correct, getting them removed from Spamhaus's blocklist, which 
involves a number of steps to appease Spamhaus to get them off the list. 

Q And that wasn't a required part of your job; that was kind of like a customer 
service that you offered for Marketing Cloud customers? 

A "Required" is an interesting term. Yeah, we did it because Soamhaus 
generally doesn't interface directly with customers. Spamhaus directly interfaces with 
the email service provider. 

So it was kind of just, like, an industry requirement, in that Soamhaus 
wouldn't -- they wouldn't usually have talked directly toa customer. They would make 
exceptions in rare cases, but generally it'd be the ESP managing that relationship. 

And you want the ESP managing that relationship. You do not want customers 
going to Spamhaus. ‘It does not go well. 

Q Okay. Ican imagine. 

So you basically tell P| "| will do the investigations and | will give you 
the information to be able to talk with the RNC, but | am not going to help remediate any 
Spamhaus problems they may be having; somebody else can do that." 

A That's correct. And the reason | did that is because | take a great deal of 
pride in everything being completely neutral. Doesn't matter -- what | care about is my 
infrastructure being clean and protected. If | was unable to be neutral, | wanted to be 
able to step away from it and not be involved at all. 

Q And what was happening in June of 2020 that made it difficult for you to be 
neutral with RNC specifically? 

A Yeah. Forme, it was BLM. It was, you know, all of the stuff around, like, 


women's rights. | think that was around the timeframe Georgia did the whole, like, 
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horrible abortion stuff. And | didn't like what | was seeing. 

Q To beclear, when you say you didn't like what you were seeing, you didn't 
like what you were seeing in the RNC emails that were being sent from the Salesforce 
platform? 

A This was specific to: | didn't like what | was seeing politically. Externally, | 
didn't like what | was seeing. | knew the RNC was heavily involved in all of the political 
stuff. So it was just, "Hey, here's what I'm seeing in terms of what this party is doing. | 
don't want to remediate." 

Q Okay. Soit wasn't that specific. It was, you just didn't like what the RNC 
was doing, and you didn't want to remediate if they got in trouble for their emails. 

A Right. | didn't like what the party was doing, and the RNC is the party, so, 
you know, | just recused myself from it. 

Q And that makes sense. 

A moment ago, we were talking about the complaints that Salesforce received 
relating to the RNC emails that you would've received from recipients who were able to 
identify that the email came from Salesforce. 

A Yes. 

Q How did they file those complaints with Salesforce other than the 
abuse@Salesforce email? 

A Sorry. You're asking, how did they file those complaints with Salesforce? 

Q_ Right. So how does a complaint get to you in the abuse department from 
an email recipient? 

A The only way you would know is by reading the headers, seeing the abuse@ 
address, and then sending that email to us. 


You may -- | mean, some people in the industry may have known the RNC was 
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using Marketing Cloud, but you would still verify through the headers. So it was pretty 
much entirely, you would know based on the headers. 

But, yeah, it was the abuse address that is how you would know. 

Q_ And that was earlier when you discussed almost, like, a tracking mechanism 
that you embedded in the headers with the X_job, that was specific to Salesforce, that 
would allow somebody to identify that it came from Salesforce and it came from 
Marketing Cloud? 

A Not necessarily. The X_job is something we used internally that we knew 
about. For you, if you were going to complain to me, as just a random citizen, you 
would know based on either the sending IP address or you would know based on the 
X-report-abuse address. 

Q- Oh, okay. So, if there was an X-report-abuse address, | could see that in 
the header and direct-email it. Or, if | was very technical, | could see an IP address in the 
X_job, reverse IP lookup, see that it was Salesforce, and contact you? 

A Clarification: The IP address would not be in the X_job. The IP address 
would be elsewhere in the headers. But yes. 

Q__lappreciate your specificity and attention to detail. 

So | want to go back, because you said there were a tsunami of complaints in June 
of 2020. Tell me what kind of types of complaints the RNC was getting, like, the bucket. 
Let's just go one by one. Like, what types of complaints? What things are people 
complaining about? 

A Yes. So, for them, those complaints mostly involved, "How did you get my 
email address? | never signed up for this." It was, "| opted out of this. Why am| still 
getting this mail?" 


Q- Allright. Sois another way to say the first one that they were getting 
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unsolicited email or spam? 

A __ That is correct. 

Q  Andthe second one, they were putting through unsubscribe requests that 
didn't get them unsubscribed? 

A __ That is correct. 

Q Did you see unsubscribe requests -- well, let me back up for asecond. If 
they sent that in, were you able to unsubscribe them? 

A | was, yes. 

Q_ Anddid you ever see somebody that you unsubscribed get resubscribed by 
the RNC? 

A | believe so. | didn't think about it at the time, but they would say, "I've 
already unsubscribed," and we'd just go unsubscribe them. | didn't do any deeper 
investigation. | probably should've, but | just didn't have the time. 

Q And were you getting complaints of something called fake headers? 

A _ That was not in June, but, yes. A lot closer to the election timeframe was 
emails where they were sending "from the desk of Kamala Harris." 


Q When you say closer to the election, are we talking the November 2020 


election? 
A We are. 
Q Okay. 


And | just want to clarify, when | say "fake header," what does that mean to you? 
Or what does a fake header mean in the industry? 

A So that would be any information that isn't accurate. So if you are Amanda 
Wick and you're sending email as, | don't know, President Biden, you are sending fake 


email. You're purporting to be President Biden, and that is not who you actually are. 
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So that would be considered false headers. 

You can also spoof an IP address, which gets into some very highly technical stuff, 
but you could pretend you're from some other infrastructure. That's alot rarer anda lot 
harder to do, as you can imagine. 

The false headers that | was seeing were pretty basic. It was, the "from" address 
was saying "from the desk of Kamala Harris." 

Q Okay. So just to be clear, so this is false header information in commercial 
electronic mail messages, right? 

A That's correct. 

Q And they were pretending to be from Kamala -- Kamala Harris? 

A Yes, that is correct. 

Q__I'msorry, | always mispronounce that. 

Were there any other fake headers that you saw, other than the emails that 
purported to be from Ms. Harris? 

A _ Those were the only fake headers | saw in my entire career. 

Q Because that's a big deal, isn't it? 

A Itis. It's a huge deal. It is -- I'm not a lawyer, but that is a CAN-SPAM 
violation through and through. _ It's also just professionally inappropriate. 

Q  Sowe'll talk about this in a minute, but, to the best of your knowledge, 
material false headers are actually in the criminal provisions of the CAN-SPAM Act, aren't 
they? 

A Possibly. | -- 

Q If you do not know, like, you can say, "| have no idea. I'm nota lawyer." If 
you don't know that, I'm not going to put words in your mouth. 


I'm curious, are you familiar with the fact that false headers are part of the 


1 


criminal provisions of CAN-SPAM? 
A | -- it wouldn't surprise me, but, no, | don't know what the criminal 


provisions -- | just know the main seven -- the top seven things in CAN-SPAM. 
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By Ms. 


And | think you said that was first time you'd seen that in your 8 years in the 


It was. 
Because that's a big deal, yes? 
Oh, yes. 


Okay. 


What happened with the fake-header type of complaint? Was there anything 


different about that when you put that forward to your boss? 


A 


There was. To my recollection, | think went to legal, and i 


said, "They cannot do this. This is a violation of CAN-SPAM." And want to say that 


legal sent the RNC a letter, but | couldn't tell you confidently. 


Q 


A 


Okay. 


But somebody had to say something to the RNC, because we had to get 


them to cut it out. 


Q 


Okay. 


And, to be clear, the way that you were able to tell that it was not from Ms. Harris 


was, the content made it pretty clear that it was, in fact, anti-Ms. Harris and not from 


desk of Ms. Harris? 


A 


It was the content. | mean, the X_job showed me it was from the RNC. 


I'm quite confident Ms. Harris would not send an email through the RNC. She would 


have other means. Yeah, it was blatantly obvious. 


Q 


Okay. 
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And, just to be clear, to the best of your knowledge, you went i 


Do you remember whether you emailed him about the fake header issue, or did you go to 
him in person, or Slack him? 

A | think it probably would've been one of those, like, "WTF is this" kind of 
Slacks. 

Q But you think there's some concern written record of you going to him about 
the fake header issue. 

A | believe so. 

Q Okay. 

A And, for us, our usage of Slacker versus email would've been, email was very 
formal. Email is when, if you needed to involve a lawyer, you needed to involve multiple 
someones. Slack was very much the quick one-off, you're conversing, it's more casual, 
more fluid. 

So it probably would've been a, like, "Yo, what is this" kind of Slack message, 
would be my guess. 

Q  Sowe were talking about the types of complaints, and we've got sending 
spam, unsubscribe request issues, fake headers. Were there also complaints related to 
the content of the emails themselves? 

A There was. 

Q And what were the complaints that you received related to the content? 

A It would've been kind of one-off stuff from people like, "What is this? "This 
content is" -- you know, "this is awful." It was sort of -- the standard kind of complaint 
stuff you get, where you're like, "Why are you sending me this? This doesn't make any 
sense. This is" -- you know, it was just stuff like that. 


From my perspective, when | would look at the content, because they would send 
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headers and the actual content of the email, | did see an escalation in terms of the 
language they were using in their emails. 
Q  So-- 


A So, originally, it was -- sorry. 


Q I'm going to come back to your concerns -- 
A Okay. 
Q- --and|'m just talking about now the complaints that you received. | got 


the impression that there was a "what on earth" tone to the complaints of the content. 
But do you remember any of the complaints that you received ever having concerns 
about violence in the tone? 

A Not to my recollection, no. 

Q Okay. It was more, "What is going on? How did they get my info? | 
never signed up for this"? 

A _ Yes, that was -- | would say that was 90 -- | mean, not 90 percent; it was 
probably 70/30. But, yes, most of it was, "How did they get my info? Why are they 
sending me email? Why are they sending me so much email?" 

Q_ And now going back to your concerns, when you were able to see the 
content of the emails, what were your concerns regarding the content? 

A So, originally, the content was kind of the language you would see, like, your 
boomer grandpa would, like, mention at Thanksgiving and stuff. It was stuff where 
you're like, okay, whatever, that's weird, but all right. 

But then it really shifted towards: Join the army, give us money to support the 
army, fight the libs, fight antifa, they're ruining America -- all of this very inflammatory 
language that made me uncomfortable. 


Q Why would the violent tone be a problem in those emails, in the sense that, 
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like, can't a customer send whatever they want, like, free speech? 

A No. So free speech, yes, but in the MSA we state, you cannot send violent 
content, you can't send -- | think we say you can't send pornographic conflict, gambling, 
drugs, like, you know, kind of all that stuff. 

It's speech in the sense that, like, you can't yell "fire" in a crowded theater. Kind 
of the same -- it's the same thing here. You can email whatever, but there are 
guardrails. 

Q_ And this goes back to what you were talking earlier with the MSA and the 
acceptable use policies for Marketing Cloud. There were rules in place, especially given 
concerns that ISPs might have if those were rules weren't in place. 

A Yes, that's correct. 

Q And did Salesforce have something called an ethical and human use 
department? 

A Theydid. The Office of Ethical and Humane Use, OEHU. 

Q_ And what did they do? 

A That is an excellent question. 

They were just starting up, | want to say, in early 2019, but don't quote me on 
that. But there was something around, like, how Al is used and, like, the ethical use of 
Al, like, sort of out in the public. Elon Musk, | think, had some stuff to say about it. 

And so it became, like, a hot thing to have an ethical and humane use, and, like, how do 
we humanely use our products and make sure it's not causing damage or whatever. 

So they were kind of weirdly also -- let me put it to you this way. Wehadacase 
with a customer -- this was in deliverability services -- where they had someone in the 
adult industry, and somebody walked past their laptop, saw what was on screen, and 


reported it, and Humane and Ethical Use got involved. And1| don't super know how, but 
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| know they were -- so it was kind of like an HR thing, kind of like an external, like, "We 
believe in ethical use." 

It was kind of -- if my words aren't tell you, it was pretty nebulous, honestly, in 
terms of, like, what they actually did and what their power was. 

Q Did you ever have discussions with them about your concerns related to the 
tsunami of emails that you were -- or, the tsunami of complaints that you were seeing in 
June 2020 -- starting in June 2020? 

A The tsunami of complaints, no. The content| was seeing, | believe | did, 
yes. 

Q Okay. 

And let me come back to that complaint -- actually, let's do that now. So what 
did you do with regards to the content in terms of escalating your concerns? 

A So, at some point -- | don't recall if it was post-election or pre-election, but it 


was somewhere in that timeframe -- | sent an email to a couple people and said -- and "a 


couple people" defined as | think; possibly P| who was Marketing 
Cloud's lawyer; | thin: possibly in -- basically saying, "Hey, here are 


some quotes I'm seeing from these emails. This doesn't look right. Like, the tenor of 
these emails is increasingly concerning." 

Q  Andsolwantto make sure | understand. So, in June 2020, you see the 
ramp-up -- and, to be clear, is it in the quantity of the emails and the tenor of the tone 
that you're concerned? 

A In June, it was just the quantity. 

Q_ The quantity. 

A The quantity kind of alerted me to, okay, this is possibly going to become a 


thing. Towards November, it was when the tone sort of shifted in a more violent 
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Q 


A 


Q 


45 


So closer to the election is when the content concerns come. 
That is correct. 


Okay. 


And so, at some point, if | understood, you raised those concerns -- and I'm going 


to come back to whom -- regarding the violent language. And | think earlier you said the 


use of the term, it was, like, "army" or "Trump army" or "fight" or something like that? 


A 


Q 


> 


Q 
A 


Yes. 

Okay. 

Like, "Join Trump's army." 

And when you send your -- it's an email you send? 


Yes. Because it was more formal, there were more people on it, that 


would've been an email. 


Q 


A 


Q 


And do you include quotes that gave you concern from the content? 
To my recollection, yes. 


Okay. Who did you email -- well, let me back up for a second. 


Do you think, the timing of that, of when you emailed them, you said it was 


pre- or post-election, but you don't know; it was sometime around the election? 


A 


Q 


A 


> YP 


> Pp 


Yes. |wantto say it was post-, but | honestly do not remember. 
Okay. 

But | know it was sometime in that, like, fall kind of timeframe. 
Sometime around the election? 

Yes. 


Okay. And do you remember who you would've sent that email to? 


| believe it would've been Po —— possibly an 
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as 


Q- And-- 
A re may or may not have been CC'd. 


Q Hold onone moment. We're going to go through those people. 


So you said your boss 


A Yes. 
Q His boss, iP 
A Yes. 


Q —=—= 1. Is she over the ethical and humane use department? 
A Yes. She's init. ae : her boss. 


Q Okay. You think you emailed one or both of them? 


A Yes. 
Q Okay. And! think you said 
A Yes. 


Q_ Andis he legal? 


A Yes. it~) is the lawyer | used to send breach notices when | was 


going to fire a client. 


ago. 


Q Okay. And was there anyone -- | think you said somebody else a moment 


A Possibly ia 
Q Okay. 
\ iz 


Q What about 
A 


It's possible, becausdill was, | think, the main lawyer over Marketing 


Cloud. | don't remember fully if was on that email. 
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Q___Isthere anyone else who might have been on the email, to the best of your 
recollection? 

A | don't think so, no. 

Q Okay. But the gist, from what | can see, is, you copy your supervisor, 
maybe your supervisor's supervisor maybe two levels up, you copy somebody from legal, 
you copy somebody from ethical and humane use. 

A Yes. 

Q Okay. 

And it's sometime around the election. You raise the concerns of the violent 
language that's -- violent/inflammatory -- | don't want to put words in your mouth, 
but -- content of what you're seeing from the RNC emails. 

What happens in response to that email? 

A From what | remember, | kind of got ignored. | don't remember there 
being a lot of response to it. At least nothing substantial that made me think, oh, okay, 
Salesforce is taking this seriously. So1|think | basically got blown off, from what | recall. 

Q Okay. 

Let me go back for one second, because | just want clarify something really 
quickly. When we were talking about the ethical and humane use department, were 
they proactive or reactive, in the sense that, like, did people have to come to them with 
complaints of something unethical or inhumane, or were they kind of out looking for 
things that might be problematic? 

A To my knowledge, they were reactive. But! didn't really deal a lot with 
them, to really be able to answer that super-accurately. But, from my perspective, they 
were pretty reactive. 


Q ___ Sitting here today, do you have any awareness of any kind of monitoring or 
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screening function that they would've had at all? 

A No. 

Q Okay. And do you remember any kind of employee hotline or anything 
targeted to employees if you had an ethics or a humane use problem? Was there 
anything that gave clarity to when employees should contact the ethical and humane use 
department? 

A There was a hotline for ethics complaints, but | think it was more of an HR 
thing. | don't know that it was, you know, this customer is doing something unethical. 

Q_ And, really quickly, | just want to go back to something that you mentioned 
earlier. | think you said something about, there was a concern that -- | think you said in 
your first interaction with the RNC you were concerned they were buying lists? 

A Yes, 

Q And why were you concerned about them buying email lists? 

A Because the acceptable use policy doesn't allow it. So, if they were buying 
lists, that would be dangerous to my infrastructure. 

Q Why? Why does that matter? 

A Because you're sending spam. You're buying a list -- so, for us, the easiest 
way to know if you were complying with policy is to ask, does this person know who | am, 
and are they expecting to hear from me? If you cannot answer that two-part question 
confidently with "yes," you're probably doing something that is in violation of policy. 

Buying a list does not satisfy either of those pieces. Those people do not know 
who you are; they are not expecting to hear from you. You are sending unsolicited 
email. 

Politically, it's just sort of known that they buy lists off each other, they trade lists. 


There's all kinds of deeply poor list practices going on. 
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So you kind of know. But there's also -- with the complaints and stuff, you can 
tell. Like, if you're saying, "| never opted in for this, | never signed up for this," and they 
gave me those vague answers in April, you can put two and two together pretty easily. 

But | can't go after them for it, because customer service. 

Q So you just answered my next question, which was, did you ask anyone from 
the RNC about list buying? And | think it sounded like you were saying that was the 
conversation in April of 2020. 

A Yeah, | couldn't ask. It had to be pretty blatant, for me to actually be able 
to go after them for it. 

Q Wait. Did you ask them if they were list buying? 

A | did not. Not to my knowledge. 

Q- Oh, okay. Okay. 

A It wouldn't have been something | would've asked. 

Q_ Gotcha. 

A Especially not so transparently, like, "Are you doing this?" Because | know 
they -- anyone would just say, "Oh, no, totally not." 

Q Okay. So you had a lot of reason to believe that they were, and there was a 
concern that if you asked them, that they would either lie or it would be a bad customer 
relationship issue. 

A Yes. Lying to me, at the abuse desk, was not uncommon -- across the 
board, from RNC or anybody else. But yes. 

Q So it sounds like -- and correct me if I'm wrong, but it sounds like, at least 
starting in April 2020 and then the tsunami in June 2020, there was a lot going on before 
you raised the concerns of violence in or around the time of the election. And it sounds 


like the RNC was not following the MSA or the acceptable use policies. But they weren't 
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getting kicked off, were they? 

A __ That is correct. 

Q  Howwas that compared to other customers? Would you say that was 
more lenient treatment than other customers? 

A Significantly. There's no other client that | can think of that we were that 
lenient with. 

Q Did you, in fact -- did you know of other clients getting kicked off the 
platform for violations of MSA or acceptable use policies? 

A Yes. It was my job to kick those customers off. 


Q You did the kicking out? 


> 


| did. 

Q And what reasons were other companies kicked out for? 

A Purchased-list usage was the highest one. Getting on multiple -- getting 
Spam- -- we called it "getting Soamhaused," but being listed on Spamhaus multiple times. 
Those were kind of my two biggest things. 

Q_ Andthe people who got kicked out, would you say they were larger 
customers or smaller customers? 

A Generally they were smaller customers. 

Q The ones who got kicked out, if you had to compare to the conduct of RNC, 
where did they fall in terms of comparatively to what RNC was doing? 

A Can you clarify the question? 

Q What! mean is, you said the RNC got a lot of leniency. For these 
companies that were kicked out, would you have said the RNC did worse behavior, the 
same behavior, or better behavior? 


A Oh, worse. | mean, once they did that false-header stuff, that was, like, top 
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on my list, worst things I've seen a customer do. 

Q And that was early, right? Because that was April. So then it just gets 
worse. And then it gets even more worse near the election? 

A _ The false-header issue was November-ish -- was after June. 

Q- Oh, that's right, because it was related to the election, so -- I'm back with 
you. 

So the false-header thing actually happens around the election. Just out of 
curiosity, do you think the false-header thing happened before or after you emailed them 
about the violent-content concern? 

A | believe it was before. 

Q Okay. 

A Because I'm fairly sure that that came up, we resolved it, and then later | 
sent -- then, timeline-wise, | think then later | sent the violent-content email. 

Q Okay. 

And did you try to take any -- so, if | understood you correctly, the false-header 
situation JIMMIRM cakes care of that, talks to legal. You think there may have been a 
letter sent. You send your email to folks, saying, "Hey, this is violent content, here are 
some examples." Nothing happened. 

Did you try to take any other action when your supervisors did nothing in 
response to your email? 

A No, | didn't. 

Q Did you communicate with anyone at Spamhaus? 

A | did not directly. Inthe email industry, some of us do have contacts at 
Spamhaus, so you can talk to them directly about certain things. Solhad asked a 


why can't we just -- you know, Spamhaus was certainly seeing stuff. We knew that. 
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We had told -- not "we," but | thin ac talked tothem. But Spamhaus was 
seeing issues with the RNC. They were buying lists. It was very obvious. Sol asked 
| | could we get them listed on Spamhaus, by chance? 

Q  Anddo you know if MM reached out to Spamhaus? 

A | believe so. | believe there were conversations between him and 
Spamhaus, because he said to me, "They're not going to list. They're afraid." 

Q_ They're not --I'msorry. They're not going to what? 

A They're not going to list the RNC on Spamhaus's blocklist. Even though 
they had plenty of evidence. This wouldn't have been out of band. 

Q Because they were afraid? 

A __ That's correct. 

Q_ Afraid of what? Do you know? 

A Donald Trump. 

Q In what sense? 

A That Twitter account was very powerful. You know, you didn't want the 
Eye of Sauron, really, coming on to you and bringing hell down upon you. 

There's also -- | know they're very litigious. So feel like Soamhaus was probably 
trying to avoid something legally, would be my guess. 

Q Spamhaus is a European company, right? 

A To my knowledge, yes. And think they're mostly volunteer-based. 

Q Okay. 

And just to be clear, it's your understanding that Ss had all those 
conversations with Spamhaus? 

A From what | remember, yes. 


Q  Anddoyou have any idea when that would've been? 
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A Sometime between June and the election, | think -- 
Q Okay. 
-- if |had to put a timeframe on it. 

Q Sol just want to talk really briefly -- | just want you to think, because we've 
talked about a lot of conversations, and | just want to go over records that you think 
might be at Salesforce that would reflect those conversations and the discussions you 
had. 

So I've got an email to you ol regarding your concerns, the violent one. 
That would've been in and around the time of the election. And we covered the 
departments that you sent that to, right? 

A Yes. 

Q Is there something called "chatter records" in Salesforce? 

A Yes. 

So Salesforce used Salesforce, obviously, to manage all of our customers. So we 
would have a record saying, hey, we have the RNC as a customer; here are all the 
products the RNC is using. And that would be on the left-hand side of the page; would 
say, here's their account team, here's all the, you know, paperwork-y info about them. 

On the right-hand side would be their chatter feed. So that would be things like, 
| could ping the account executive and say, "Hey, here's what's going on with the account. 
Please contact them." It would keep a record of the calls and just sort of a feed of 
activity that went on in the account. 

Q Anddid you guys use Slack as a communication method? 

A Wedid. 


Q Did you Slack regarding the RNC being a problem? 


A Almost definitely, yes. 
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Q Okay. 

Would you have had conversations -- earlier you said when you had conversations 
with customers, you tended to do it via email. Do you think there would've been email 
conversations between either you im, to the extent that they exist in email, 
between you or ee: representatives of the RNC? 

A Not via email, no. We had our own ticketing system. So that would've 
been through -- our own Service Cloud instance was how we managed all of our customer 
cases. 

Q Can you explain that? 

A In terms of? 

Q_ This is the -- | want to be clear that we're talking about the same thing. 

This is the tickets that you used to deal with customer -- with complaints, or tickets that 
you used to deal with the RNC? 

A Both. 

So we would get a complaint into Service Cloud. We would then create a case, 
still in Service Cloud. And then we would correspond with the client there. And that 
was partially to protect my team, so that you wouldn't be sending, like, these emails 
directly to people, and so that you would have a record. 


So, like, | could go look at a case, versus me having to, like, go figure out what's in 


20 a: email or whatever it was. So it was one centralized location, where we all knew 
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the status of acase. Wecould go in, figure it out -- that kind of stuff. 

But it was all done -- it was all an email ticketing system, so -- 

Q Okay. Sol want to make sure! understand that. Soacomplaint from an 
email recipient against the RNC would come in. You would create a ticket in Service 


Cloud -- 
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A No. That automatically creates a ticket. 


Pp 


Oh, okay. It automatically creates a ticket in Service Cloud. 

A Yes. 

Q Okay. And then that would record the customer's complaint. 

A Yes. 

Q_ And, then, that record you could use to communicate with your customer, 
the RNC. 

A We would create a separate case. So you'd get the complaint; we would 


create a new case linked to that complaint -- 


Q And-- 
A _ --to direct report someone (ph) with the RNC, yes. 
Q Gotit. 


And then, in that new case, there could be communications directly with the RNC 
about the complaint which was in the previous case. 

A Yes. We would never give -- we didn't usually give the customer the actual 
content of the complaint, to protect the person who was complaining. 

Q  Atsome point, didn't you, though, to explain the allegations against them, or 
no? 

A We'd give them the email address and say, this email address has 
complained. But we wouldn't give them the actual content of the complaint. 

Q Gotcha. Okay. 

And so you were able to have communications with the RNC through those 


Service Cloud tickets. 
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And was there also a Slack channel called Email Geeks? 

A That was a -- that was not with Salesforce. That was a -- that's an external 
Slack thing. It's not a channel, it's an organization. 

Q Okay. Sois that a public organization on Slack? 

A Semi. | think you have to fill out an application for membership. But it's a 
free membership; you just have to be in the email industry. 

Q  Dovyou have to sufficiently prove your email-geekness? Is there a test? 

A Like a hazing? Not to my knowledge, no. 

Q Okay. 

So | want to change gears a little bit and talk about the records that -- just one 
moment, okay? 

A Sure. 

[Pause in proceedings.] 

Ms. i. Sorry about that. We had a little sound issue on our end. 
Apologies. 

Okay. Sol just want to change gears and talk about -- by the way, let me pause 
fora moment. How are you doing on comfort? Do you wantabreak? Are we okay? 
We both have been drinking coffee. Do we need a comfort break? 

The Witness. A comfort break would be great. | was just about to request that. 

Ms. | could kind of feel collectively. So let's dothis. Let's take -- is 
5 minutes? Ten minutes? How long would you like? 

The Witness. Five would be perfectly fine. 

Ms. a. Okay. So why don't we take -- we'll take 8. We'll go into recess at 
11:30, and we'll come back at 11:35. And, if you want, you can just turn off your video 


and your sound, and we'll come back at 11:35. 
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The Witness. Okay. Thank you. 

Ms a. Okay. We'll be off the record and in recess until 11:35. 

[Recess. ] 

Ms. © So we'll come back from recess and go back on the record at 11:37. 

BY MS. 

Q And was there something that you want to clarify from before? 

A Yes. Interms of the Spamhaus relationship, it wasn't -- just to be 
ultra-clear on this, it wasn't that | could go to Spamhaus and say, "Hey, will you please list 
this client that | would like listed?" Spamhaus did not operate -- does not operate that 
way. 

You could go to them and say, "Hey, we know we're seeing issues. Are you 
seeing issues? Can you explain why you're not listing?" Or, you know, "Are you seeing 
things?" and stuff like that. 

If they thought it was sufficient to list, they would list. But you couldn't just be 
like,""Do mea solid. List this." That's not how they operate. They're very, very 
regimented in terms of that. 

So | just want to make that super-clear. 

Q | guess the impression | got from what you were saying was that it was more 
that you could flag to them somebody that they should look into further to see if that 
entity would meet the -- put them on the blacklist requirements. 

A Blocklist, but yes. 

Q__Blocklist. 

A Sorry. | have to correct it everywhere | go. 

Q  No,no. That television show called "The Blacklist" isn't helping. So 


apologies for that. | will try to remember it's "blocklist." 
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But | guess -- | didn't get the impression earlier that you were saying we called up 
Spamhaus and said, kick them off. | got the impression that you went to es 
and said, you could have conversations with them about this and put the RNC on their 
radar to look at those IP addresses and see if their activity would merit blocklisting. 

A Okay. Yes, that's accurate. Yeah. It wasn't, please do this for us. 

Yeah, your interpretation is correct. 

Q_ And if | understood you correctly, whatever conversations i had 
with whatever representatives at Soamhaus, to the extent that he did, what he relayed 
back to you was: They don't want to do that because they're afraid of Trump and the 
ramifications of taking action against him. 

A __ That's correct. 

Q Okay. 

So, before the break, | was going to change gears a little bit and ask you about the 
records that the RNC would've access to as Marketing Cloud customers, what Marketing 
Cloud metrics they would be able to see when they send out email campaigns. 

A So, when you send an email, you will get back the bounce rate. So that's 
how many hard bounces you have. | believe Marketing Cloud does a soft bounce rate. 
You'd get the number of complaints. You'd get the number of unsubscribes. 

And engagement data may have been included in Marketing Cloud's reports. | 
never saw how Marketing Cloud actually reported back. But this is standard of 
any -- any email you send, you would expect to see those results back. That's the whole 
point. 

Oh, you'd see opens as well. _|'m sorry. 

Q Okay. Socan you walk me through some of the terms that you used there? 


A Ican. Which would you like to start with? 
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Q Sol think you said, the first thing was a soft bounce rate? 

A So there's two different types of bounces. There's a hard bounce, and 
there's a soft bounce. And that depends on the code that a server sends back. 

So | might send an emailto you. Your receiving server says, "No, there's no one 
here." That'sahard bounce. "That does not exist. Don't try this again." That 
usually is a 5 code, so 550, 5-dot-2-dot-1-dot-whatever. 

Or it could be soft bounce. So let's say your mailbox is full. Let's say there's 
just some sort of weird temporary error. It would send back -- generally would send 
back a 4 code, 400-and-some-odd. And that would tell me, okay, the mailbox is full. 
The address is probably deliverable; there's just something else going on. That is a soft 
bounce. 

Hard bounce is: Do not mail again, there is nobody here, cut it out. Soft is: 
There's something technical, we're not sure, maybe try later. 

Q And would the RNC get soft and hard bounce rates or just soft? 

A It would be both. Because hard bounces should opt you out of email 
settings because the address doesn't exist. So it should mark you as "do not email." 

Q  Soyou said bounce rates. | think you said -- would they receive open 
rates? 

A Yes. 

Q Okay. And what were the other metrics? | think that you said -- would 
they receive complaint rates? 

A Yes. And -- 

Q_ And that -- go ahead. 

A To clarify, that is -- clicking "this is spam" in your email client will actually go 


through what's known as a feedback loop. So you click "this is spam." That goes back 
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and reports back and says, "Hey, this person clicked 'this is spam.’ We're going to mark 
them as 'do not email." 

My team was not included in those reports because ours was directly email-based. 
You wouldn't have any way of technically knowing that we were running an investigation 
or there had been a complaint through our team. 

Q So, when we talk about the complaint rates that RNC would've had access to 
and would've seen in its Marketing Cloud data, we are not talking about the complaints 
that were manually sent to your team through the abuse@Salesforce or however other 
method that it would get to you. We are talking about somebody that somebody 
would've automatically clicked -- or, somebody would've clicked in an email that you 
received from the RNC that would've gone directly back to the RNC. 

A _ That is correct. 

Q Okay. 

And is there an assumption about what email senders are supposed to do with 
those complaint rates? Like, what's the value of knowing your complaint rate? 

A So the value of knowing your complaint rate is what your overall reputation 
is. So, if you have a very high complaint rate, your mail is more likely to go to the spam 
folder instead of the inbox. So that's something you definitely want to keep track of. 

Now, | will say, that can be harder with Gmail specifically. Because usually when 
you get a feedback loop complaint, you know what email address specifically complained. 
Gmail does it so that you don't actually know what address complained. So Gmail'sa 
little bit weird. 

But, yes, ultimately, that complaint rate is important because it determines your 
reputation, and reputation is everything in this industry. 


Q  Andwhen you say "your reputation," do you mean the reputation of 
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Marketing Cloud or the RNC? 

A Could be both. If we don't care about those complaints and we're not 
actually taking action, that's our infrastructure, that is our reputation. 

But, specifically, if the RNC gets a bunch of complaints and we're doing everything 
we can and that's known in the industry, it would be the RNC's email reputation -- the 
reputation of that IP address. Is this mail something that should go to the inbox, or is 
this mail something that should go to the spam folder? 

Q Now, a moment ago when you were talking about the complaint rates, | 
think you said that was from somebody clicking in their email something like "this is 
spam"? 

A Yes. 

Q But could they also -- could the RNC also see unsubscribes in their metrics? 

A Yes, 

Q_ And what is that? 

A _ That is when you click the "unsubscribe" button. And that's -- 


At the bottom of an email? 


> YP 


Yes. | think Gmail does it so that there's also an "unsub" at the top that you 
can also click, and that would also come into your metrics. 

Q  Andso RNC would be able to see every time somebody unsubscribed and 
every time somebody clicked "this is spam." 

A Yes. Again, assuming you're not on Gmail, because Gmailis special. But 
yes. 

Q_ So, while they wouldn't be able to know the complaints that your unit 
received, they would have a good idea if people clicked "this is spam" or "unsubscribe." 


A They would. 
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Q Are there other ways -- are there other metrics that the RNC would have in 
Marketing Cloud that would indicate negative feedback or complaints? 

A Not complaints. They probably would also have click data. That's 
basically knowing what links were clicked on. And guess, in a way, if, like, people aren't 
clicking the links, you could kind of tell whether your mail's being well-received. We call 
that "engagement" just sort of as a general umbrella. People are not engaging with your 
mail. 

But, otherwise, those are kind of the big things. If you know your hard bounce 
rate is really bad, your list is bad, those are your -- those are your metrics. 

Q Okay. So it sounds like you're saying -- and you said the soft bounce rate is 
kind of unclear because it could be technical issues, but the real one to know that you've 
got problems is the hard bounce rate. 

A That'scorrect. If you have a high hard bounce rate, something's wrong 
with your list. 

Q_ And so they would've been able to see their hard bounce rate in their 
metrics; they would've been able to see their complaint rates in their metrics; they 
would've been able to see their unsubscribes in their metrics. 

A Yes. 

Q Okay. 

So now | want to turn to the events of what happened on January 6th. 

Can you -- and | just want to kind of go back for one second. The last thing that | 
remember you saying timeline-wise was, around the time of the election, there's the 
Kamala Harris fake-header email, which you do believe went out to people? 

A ldo. Well, it would have to have gone out to people for me toseeit. My 


team was reactive. So! would have to have gotten a complaint from someone who had 
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received that mail. 

Q Okay. And you believe that was before the email to your supervisors, legal, 
and ethical and humane about the violent tone, which was on or around sometime of the 
election? 

A To my knowledge, yes. 

Q Does anything happen between that email on or around the time of the 
election and the events of January 6th? 

A Nothing -- nothing significant that | can recall, no. 

Q Okay. 

So January 6th happens. Just walk us through that day. What do you 
remember in terms of, where are you, when do you learn of the violence? 

A _ Yeah, that was a -- that was a traumatic day. 

Well, so | work from home, sol was athome. And from what | recall, | think my 
husband told me that there had been violence at the Capitol. And | think it was 
sometime that afternoon, like, 2, 3 o'clock-ish, if | had to pinpoint it. 

Q_ And, understanding that this is a personal question, but what was your 
personal reaction at the time that you found out about the violence? 

A Very much, "Holy shit. Whatis going on?" There was a lot of texting 
between, you know, all the family members and stuff of, like, "What is happening? How 
horrible is this?" 

My husband's mother said it was a false flag, it was antifa dressed as Trump 
supporters. There was all -- you know, all of that. 

Q_ Every family's got one. Don't worry about it. 

But were you watching on television? 


A | was not. | think my husband was watching on one of his computer 
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screens, but | tried not to be involved. _ It was terrifying. 

Q And were you working that day? 

A | was. 

Q Okay. Did you talk with any of your coworkers about what was happening? 

A I'm pretty confident | talked ‘fl 

Q  Anddo you remember the conversation that you had? Did you Slack? 
Did you call? Did you text? 

A _ That would've been Slack. 

Q Okay. And do you remember the conversation that you had with fi 
ae i: Slack that day? 

A No, | don't remember anything from it. 

| do remember that | -- at some point either that day or some other point in that 
timeframe, | did block their email sending. 

Q  Who-- 

A Yeah, I'm sorry. The RNC's email sending. 

Q Yeah, so let's -- let's talk about that. When you say you blocked the -- so 
did you ell TT that you were going to take some action against the RNC's 
account? 

A | think so. 

Q_ And, to the extent that you remember, what did you tell him? 

A To the extent that | remember, | would've had to have said to him, "I'm 
going to block their email sending," because, | mean, again, like, everything was in 
writing, but also, ike [MMM needed to know, because there was going to be -- there was 
going to be some potential blow-back from that. Sol was kind of getting ahead of it, if 


that happened. 
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Q_ Tothe best of your recollection, what do you remember saying to him 
exactly in Slack? 

A To the best of my recollection, | would've been pretty direct about it. | 
would've just said, "| am blocking their sending." 

Q No, | was just curious, like, are you like, "I'm shutting it down," or is it more 
technical, "I'm blocking it"? Did you explain how you would do it, or is it more -- was it 
an in-depth explanation, or is it, "I'm shutting them down"? 

A Yeah, it wasn't -- it wasn't in-depth at all. Weknew what it meant. So 
there was no reason to overexplain it. It was just, "I'm going to shut them down." 

Q So he did know what you meant technically when you said you were shutting 
it down? 

A Yes. We knew what blocking email sending meant. It was common 
across the team. 

Q Across your team? 

A Yes. 

Q___ Did folks outside of your team know how you shut it down? 

A From a technical perspective in terms of how it's done, or just what it 
meant? 

Q Theformer. Did they know how you actually mechanically did it? 

Maybe one or two people might've known how. Al on the deliverability 
team would've known. Maybe Mike Wright would've known, in the IT MTA, the 


technical setup team. Nota lot of people. 


Q_ The higher-ups above would they have known how you did 


A | sincerely doubt it. 


that? 
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Q And how did you do it? 

A So the way you suspend email in Marketing Cloud is: You go into their 
account. Yousearchthe record. You click into the account -- the details technically in 
terms of what's in their account. You gettothe IP address. You copy the IP address. 
You type in "black hole." You click "save changes." 

There's another screen that comes up and says, "Are you sure you want to make 
these changes?" And you click "yes" or "okay" or whatever it was. But, yes, it was the 
"save changes" button and then "okay." 

And then | -- and | mentioned copying that IP address. | would copy that IP 
address and send it to myself in Slack to let myself know what the IP address was, what 
the account was, and that it had been blocked. 

Q  So-- 

A Because, to my knowledge, Marketing Cloud didn't keep records of who 
blocked what when, so | wanted to keep my own records. 

Q So, to be clear, when you say you chatted yourself, you Slacked yourself, 
which is, like, almost like a note to yourself, and created a record that would've had the 
RNC's IP address init. And did you note "blocked," or would it just be the IP address? 

A It -- usually, | just -- like, if | was messaging myself with an account ID and IP 
address, | knew what | was doing. That was my setup to myself. And it possibly would 
have said "RNC." 

Q Okay. 

A So, yeah, | knew, because that was just how | kept my records. 

Q So, sometime on January 6th or maybe possibly January 7th, but on or soon 
after that day, there should be a Slack record of you slacking yourself with "RNC" -- well, 


possibly "RNC," but with the RNC's IP address, and that's when you would've copied, 
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pasted, saved changes, and shut it down. 

A __ That is correct. 

Q_I'mnot goingtolie. | am disappointed that it wasn't a big red button on 
the side of the wall. 

A I'm sorry. Wecan make a product request. 

Q How long did the shutdown last? 

A It was a couple days. __| think it was up to -- | think it was the rest of the 
week, and | want to say it was up to that Monday. 

Q_ That would've been January 11th? 

A | believe so. 

Q_ Anddid you tell anyone other than hat you were shutting it 
down? 

A | might've verbally said it to my husband. 

Q  Anddo you know if it -- 

A But | don't -- 

Q- Oh,I'msorry. | didn't mean to cut you off. Go ahead. 

A 


Oh. But! don't think | did it to anybody else that | can recall. 


Q Anybody else at Salesforce? 

A Correct. And -- 

Q_ Right. 

A No. We were both at Salesforce at the time, sono. Yeah. 


Q Who was the other individual you told? 
A 


| om husband. We met at Salesforce. 


Q  Oh,okay. Oh, sorry. | wasn't sure if it was somebody other than your 


partner. 
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A Oh. 

Q Okay. So your partner was the only person that you think you told other 

A | believe so, yes. 

Q Okay. 

And understanding, best of your recollection just sitting here today. So if it's not, 
it's fine. We're just trying to remember if there's anyone else who would've known in 
real-time that you were shutting it down. 

Do you know if ae vo anyone that you shut it down at Salesforce? 

A | think he prob- -- | mean, reasonably, he probably would have to have, 
because he later came back to me to tell me to unsuspend them. So| think someone 
must have -- | mean would have to have known, because | a said, "Hey, 
when are they getting unsuspended?" So, yes, | think must --yeah. Logically, 

BA woud have to have known. 
Q Sol just want to be clear, we're talking about a 
A Weare. 


Q- --whois three layers above you? 


A He's is boss's boss. 
oO veh, 5: 
A 


Yes. 
Q So three-layers-above-you comes to you and asks, when is it getting turned 
back on? 
A Yes. So, from what | recall -- and this is very clear in my mind, but you 
know how brains can be. But, from my recollection, PE «ales me and said, "You 


need to unsuspend them." And my reaction was, "What?" You know, it was very, 


24 


25 


69 


"WTF?" Like, "You do realize what happened last week?", kind of, like, incredulous. 

And a: "It's okay. You know, this goes all the way up tothe top. This 
is so much higher than you and me. ‘The higher-ups are going to be reviewing their 
content before it goes out. So we need to unsuspend, and you need to ell when 
it has been unsuspended." 

Q Okay. 

So is it fair to say that when asked you, when is it getting turned back on, 
that it was your impression that nobody knew how to do it other than you? 

A Yeah. It was weird, because BR: 2iec me on how to turn it back on. 
| have no idea why he didn't just do it. 

Q Well, is it possible that TR cian re he also 


knew how to turn it back on, and EEthought you were the only person who 


knew how to turn it back on? 


A It's entirely possible, yes. 


Q So, if| understood you BE says, turn it back on and ping 
| | presumably on Slack? 


A Yes. 
Q__ So ping -- 
Yeah, anytime we say "ping," it means Slack. 

Q iim says, turn it back on and ping TT on Slack when 
it's back on. 

And a moment ago you said -- | don't want to put words in your mouth, but it 
sounded like, when TE old you to turn it back on, it sounded almost like you 
didn't immediately say yes? You almost said -- it sounded like you almost put conditions 


on turning it back on, and what is the solution, because the solution can't be letting them 
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continue to send those emails? 

A Yes. And | very obviously didn't have that power to say no, but | was like, 
how could this be okay? Like, | want an explanation. Like, what in the world? Why 
would we ever do that? Why wouldn't we kick them off ASAP because of -- look at what 
just happened. 

Q- Andthis--I'msorry. Did | cut you off? 

A No, | was just -- it was just like, | could not believe that we were doing this. 

Q_ And this is when says, in response to your concern about how 
are we turning this back on, don't worry, this is being handled by the higher-ups, and 
somebody is going to review all the emails before they are sent out. 

A Yes. 

Q Okay. 

And did you happen to see the press articles that were released on 
January 11th -- | believe the first one may have been Vice, but | think there were other 
articles that were put out. But on or around January 11th there were articles that stated 
that Salesforce had, quote, "taken action" against the RNC. Did you have a chance 
to -- did you see any of those articles when they came out? 

A | think it was the Vice article that | saw, where they had, quote/unquote, 
"taken action," yes. 

Q_ Anddid you see in that article where Salesforce had a prepared statement 
from a spokesperson? 

A Yeah. Anytime they talked to the public, they would definitely have gone 
through PR, yes. 

Q Were you part of crafting that statement that Salesforce put out? 


A In no way whatsoever. 
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Q Do you know who was responsible for crafting that statement? 

A Probably -- | mean, probably the PRteam. And! would assume the C-level 
execs, given how high up of a case it was. 

Q_ Tothe best of your recollection, do you remember who was on the PR team 
that would've handled it? 

A Oh, no idea. 

Q Okay. 

And sitting here today, do you, in fact, know whether had any 
conversations with those higher-ups about this? 

A He probably did. | mean, like, how high up, | guess is my -- 

Q Well, let me rephrase. oi TE 0 you that he had any 
conversations with anyone higher up about it? 

A He heavily implied it, yes. 

Q Okay. So he may not have said he had the conversations, but he may have 
said conversations are being held by the higher-ups. 

A Yes. 

Q Okay. 

And did anyone other than or —z talk with you about the 
action that you took against the RNC? 

A Not that | recall, no. 

Q Okay. 

In the article that referred to the, quote, "action" that Salesforce took, the articles 
repeatedly say that Salesforce wouldn't discuss what action it, in fact, took. 

But, sitting here today, do you know what action Salesforce took on January 11th? 


A The only thing | was told was that they would review the content before it 
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went out. 

Q So -- but that was because they were turning it back on and they were telling 
you to turn it back on. 

A Yes. Theactionwas: Turnitbackon. Letthemsend. We're going to 
review the content. That's the action we're taking to make sure this doesn't happen 
again. 

Q_ And, sitting here, you don't actually know who the higher-up was that would 
be reviewing those emails, do you? 

A I'm not even sure if it was a higher-up reviewing the emails or if it was some 
poor person who had to deal with it. | don't -- | have no idea. 

Q Do you know -- 

A But | was not involved, and | should've been. 

Q Doyou have any idea who would've been assigned to review those emails, if 
they did, in fact, give it to a person? 

A Yeah, my -- 

Q Whose job -- go ahead. 

A My best guess, if it wasn't a higher-up -- and it should've been -- would've 
been someone in deliverability services. 

And, to clarify, the deliverability services team is a team that you basically buy a 
block of hours from, and then you have those hours for strategy, execution, whatever it 
is. 

My guess would be, if | had to, it would be that team. But it really should've 
been an exec. 

Q Okay. 


And, sitting here today, all of the conversations that happened above you 
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regarding the statement and taking action and, quote, "the higher-ups," to the extent 
that those happened, is it your understanding that was involved in those 
discussions with management? 

A He heavily implied that he was, from my recollection, but he wasn't very 
direct with me. 

Q Okay. And he never said who he spoke with about it? 

A He did not. 

Q Okay. 

A | know -- like, | know he was involved with a because, like, logically, he 
would've been. But | don't know anything really past that. 

Q But you're assuming that just based on their roles? 

A Yes, 

Q Okay. 

And after you turned back on the RNC's ability to send emails, | believe on or 
around January 11th, do the emails start getting re-sent? Like, is it a slow trickle back 
up, or is it throttle back on? 

A | do not know. | would assume it would have to be slower if they were 
reviewing the content, just naturally. But! don't really know. 

| think -- | think it would've -- | mean, it would've had to have been slower that 
way, but they were also probably slower because, like, it was kind of ashock. But I'm 
not super-confident of that answer. 

Q__ So, after you turn it back on, do you keep getting complaints from recipients 
of the RNC regarding the emails? 

A Not nearly as many. It dropped off significantly in terms of complaints that 


l saw. 
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Q_ And, after that, what happens to the abuse and compliance department at 
Salesforce? 

A Well, we all wound up leaving. 

Q_ And this is when 4 months later they don't hire right? 

A This is correct, yes. 

Q And they don't provide you resources and they don't provide you bodies? 

A They provide me with absolutely nothing. 

Q_ And there's still no real functional abuse desk for people who email 
abuse@Salesforce? 

A Not to my knowledge, no. And the team now is two people; it's one person 
and a contractor, when it should be a much bigger team. 

Q Did you have any communications after leaving Salesforce with anyone 
regarding the events on January 6th? 

A  ldid. 

Q = And who was that? 

A With anyone, would've been like, you know, my mom, my dad, my 
grandfather. You want Salesforce employees or just, like, people | talked to? 

Q  No,I don't mean, like, anytime you talk about January 6th. | guess | kind of 
mean more related to -- | don't want to say "your role," that's not what I'm saying, but 
the actions you took or what happened at Salesforce on or around January 6th. 

A Oh. _ ——SSSS==s who told me she had contacted 
you guys. 

Q You --| believe you produced a document in this case, yes? 

A Yes. 


Q_ Sol'm going to show you what's been marked as exhibit 1. 
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Okay. 


And, hopefully, if this works, it should pop up on your screen. Maybe? 


No? One moment. 


A 


Q 


Q 


Okay. 

There we go. Can you see that? 

| can. 

So you produced this, what looks like a text exchange? 

Facebook Messenger. 

I'm sorry? 

It's Facebook Messenger. 

Oh, okay, a Facebook Messenger exchange. And who was this with? 
This was with my husband. 


Okay. And you sent this -- and I'm sorry, | can't see from here. Are you 


able to see the date that you sent that to him? 


A 


Q 


Yes. That was January 9, 2021. 


Okay. And you sent him an article that looks to be -- we can't click on it, 


but it looks to be that it was an article about the attempted coup, likely discussing the 


events on January 6th? 


A 


Q 
Q 
A 


Q 


That's correct. 

And then | believe there's a second page to this? 

There is. 

Just give us one second to access that. One moment real quick. 
Sure. 


And this is the second part of the text, and you say, "Oh my God," and then it 


looks like there's an email? 
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Yes. That was one of the emails from the RNC. 


And you say -- we might be able to zoom in on the image, actually. 


Did you highlight those words? 


A 


| think those were highlighted from Twitter. | wouldn't really have known 


how to highlight an image, or | wouldn't have done it. 


Q 


A 


Q 


So you think you -- did you grab the image of that email from Twitter? 
Yes. 


And then you sent it to your partner and said, "This was one of the emails |" 


dot, dot, dot, dot, dot. 


A 
Q 
A 


Q 


Yes. 
And what did you mean there? 
This was one of the emails that | had called out. 


When you say "called out," are you referring to the excerpts that you sent to 


your supervisors that you had concerns with? 


A 


Yes. It was the, "You'd make an excellent addition to the Trump army," 


"exclusive Trump army," "let everyone know you're the President's first line of defense 


when it comes to fighting off the liberal mob." Yes. 


Q Okay. 

And then, if we could scroll down, "This was one of the emails |... It's blowing up 
on Twitter." What was blowing up? 

A This email was just -- like, people were tweeting about it. 

Q Because of the language? 

A Yes. 


> Pp 


And, if you scroll down, your partner says, "Sent by Salesforce TM"? 


Yeah. 
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Q What is "TM"? 

A He's just screwing around. "Trademark." 
Q Oh, okay. 

A Yeah, 

Q 9 Okay. 


And, then, is there anything else below that? | don't think -- that's it. 

A No. 

Q Okay. And so you sent that to -- so that, actually, January 9th, that was 
before -- it was after you shut it down but before you were told to turn it back on? 

A Yes. 

Q So the news and Twitter -- I'll just say "the news" -- but people were 
essentially blowing up and discussing the violent rhetoric that had been in these emails. 

A Yes. Yeah. It was allover Twitter. There was a Twitter account that was 
actually tracking the emails. | don't know if that was -- | think it was before January 6th. 
They were just tracking all the emails. But, yes, it was all over Twitter. 


Q Is that the Trump Fundraising Emails Twitter account -- 


A Yes, 

Q_ --that you were referring to? 
A Yes, 

Q Okay. 


And do you remember having any conversations, either with your partner or 
anyone at Salesforce, when it was all blowing up on Twitter about the fact that you had 
shut the emails down? 

A Twitter didn't know that | -- | mean, nobody knew that | had shut 


the -- nobody publicly knew. So, | mean, I'm certain it came up in discussions, because it 
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was, like, the big topic, so almost definitely, yes. 

Q Well, | guess what | -- and let me be clear. | don't want to get into, like, the 
dinnertime conversations with your partner or your family. 

What I'm more saying is that the timing of this, and it's blowing up on Twitter, and 
people are talking about the emails that came through the Salesforce platform. Is 
anybody talking, at Salesforce, about the fact that the content of the emails that 
Salesforce had sent on behalf of the RNC are blowing up because of their violent nature? 

A _ That I'm not sure of. 

Q Oh. So nobody, to you, talked with you about it at Salesforce? 

A __ That's correct. 

Q_ And you're all working from home, so there's no real water-cooler talk. 

A __ That's correct. 


Okay. 


> Pp 


And my whole team worked from home anyway, even before the pandemic. 
But, yes, | wouldn't have been privy to those conversations. 

Q_ And from the time that January 6th happens until the January 11th 
conversations to turn it back on, while it's blowing up on Twitter that these emails were 
inflammatory [i never reaches out to you and never contacts you to discuss that it 
was shut down? 

A To my recollection, | -- | honestly don't know. 

Q Did you get the impression that after you shut it down on the 6th until the 
time that he reaches back out to you, that there's just something happening at the higher 
levels at Salesforce that was beyond you? 

A Yes. There was that general feeling of flurry. But | don't recall having -- | 


don't recall any conversations that | can relay. 
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Q Just out of curiosity -- | don't know if you can see; we may not be able to 
zoom -- but is there a date to that email? 

A No. 

Q Okay. But you think you pulled this somewhere off of Twitter possibly on 
the date that you sent it, on January 9th? 

A Oh, yes, | would've. That would've been -- like, as part of the content of 


the conversation, | would've pulled it that day. | don't -- if | take a screenshot, I'm 


sending it -- 
Q Okay. 
A -- same day. 


Q Okay. So there's a good chance that that email was reported on January 
9th, even though it likely had been sent earlier? 
A Right. Like, it would've been on Twitter January 9th, but the date it was 


actually sent would've been unknown. 
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[12:10 p.m.] 

Q Okay. And think we can -- we have the text of that. Okay. So that's 
very helpful. 

Have you talked with anyone at Salesforce since you left who's currently at 
Salesforce? 

A Yes, 


Q Who? 


> 


Q = And who is that? 

A She works in deliverability. Not delivery services; deliverability. We're 
very close friends. 

Q_ Andis that just a regular friendship, or have you had any conversations 
pertinent to anything we've discussed today? 

A | definitely did ping her, | messaged her on Facebook, talking about 
Salesforce's -- your request to Salesforce for documents. And|said something along the 
lines of, like, "Oh my God, am | gonna be subpoenaed? Am | gonna have to go in front 
of Congress to testify? How safe am|!gonna be?" Like, it was very -- | was very scared 
of, like, if any of this goes public, what's going to happen to me? 

Q And what do you mean by that? 

A | mean the internet's a very scary place. | mean people can come after you 
personally. | mean, | was -- | mean, | even said this -- | said it to my mom, like, "I was the 
one who did this," and my mom was like, "You could be killed." Which, thanks, Mom, 
but -- 


Q . Didshe mean by antifa? Or--no. Sorry. Oh, no, no, sorry, that was 
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your partner's mom, wasn't it? Apologies. 
A Mom, actually, also. | have two of them. 


Q- Oh-- 


> 


Yeah, uh-huh. Yeah. 

Q_ --bless your heart. 

A My mom also said, like, "Don't tell your grandfather any of this." So, like, 
I've got a couple of them in the family. 

Yeah. It was, "You could be killed. They could come after you. They're going 
to -- you need to not say anything." Mom was very, very afraid for me. 

Q_ Andis that why you had strong safety concerns about coming forward? 

A Yes, absolutely. And that's why I'm still a little concerned about this 
transcript becoming public too. 

Q And very much understand that, which is why we're obviously using the 
security concern of not using your name. 

And to the extent that | made a joke a moment ago, please understand that, while 
| take family issues on the lighter side, | was not making a joke about your safety, which 
we take very seriously and is not a joking matter. 

So | just want to make sure that my levity regarding your mom's -- parents is not 
to be conflated with her reasonable concern about your safety. 

A No, the levity was appreciated. 

Q Okay. Sometimes it's needed when we're talking about a topic like this, 
which we very much appreciate is sometimes emotionally difficult. 

Did you talk with BE since leaving Salesforce? 

A Yes. 


Q And what conversations have you had with him? 
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A So, first, it was still along the lines of, like, oh, man, here's the Salesforce 
document request, our names are all over it, we're going to be involved, what's up -- you 
know, kind of all that stuff. 

We had an informal discussion this week. He contacted me, what, Wednesday, 
and said that he had been contacted by your team, and we discussed a little bit of it then. 

Q  Anddid he seem concerned? 

A He didn't -- well, he said he'd talked to a couple lawyers, that he'd 
gotten -- he'd had three lawyers involved, and that one of the lawyers -- either one or 
multiple of the lawyers was going to contact Salesforce and have Salesforce pay for his 
legal team, that | could expect to probably hear from someone at Salesforce. 

He said he would do everything to protect me from having to testify. | said, 
"Yeah, but | was the one who suspended the email, so I'm going to be involved." 

Q_ And have you contacted -- 

A _ |didn't -- 

Q_ I'msorry. Go ahead. 

A | will also say that | didn't feel safe discussing that | had already been 
involved. So|did play it off as, like, what kind of lawyer would | need? Am | going 
to -- you know, | definitely played off like | was not involved, just out of trying to be very, 
very thoughtful around my own safety and around just, like, nobody knowing what I'm 
doing. 

Q_ And, just to be clear, a moment ago it sounded like you said that | 
=z intended to contact Salesforce regarding his contact with the committee but 
also possibly to see if they would pay his legal fees? 

A He contacted a lawyer. | think the lawyer was going to contact Salesforce. 


| don't think i was going to contact Salesforce directly. 
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Q  Ah,okay. Okay. But he mentioned something about having his legal fees 
paid for by Salesforce? 

A _ That's correct. 

Q Was there something that gave him the impression that they would do that? 

A | think it was -- yes, because he was employed by Salesforce at the time, and 
he wouldn't have to be involved in this if he wasn't employed by Salesforce. So kind of 
like an "it's their fault, they should pay" kind of deal. 

Q This was his -- well, no, I'm not going to make that comment. 

Was there anyone else that you have spoken with after leaving Salesforce who 
was employed with you at Salesforce, anyone other than TE (com Salesforce 
that you've spoken with since leaving? 

A Around these events or just in general? 


Q Just in general. 


A Okay. = i [el a. course. |B little bit. Who 
else? cee. who was a -- he's an SE. es who's in support. | have a couple -- 


Q Okay. These are all friends that you used to -- 


A Yeah. 
Q -- have at Salesforce? 
A Yeah. 


Q Okay. But have you talked with any of them about anything that we've 


talked about today? 


A | Ea es. yes. aa obviously, | already told you. | think 


otherwise I've been pretty quiet about it. 


Q And what conversations did you have with me: 


A That was, again, sending that document link and being like, "Oh my God. 
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WTF. What's gonnahappen? Thisisveryscary. I'mveryscared." That was pretty 
much -- that's pretty much been it. 

al also said to me, "I'm glad | never touched the Marketing Cloud infrastructure 
and don't have to deal with this." | was like, "Thanks 

Q And were those reach-outs also Facebook Messenger or texts? 

A Would've been text. 

Q And what «a say when you reached out? 

A a: mainly like, "LOL. I'm acontractor. Glad | only sent those to 
you." Basically, like, a "better you than me" kind of thing. But end | are 
actually, like, also friends outside of work. So, you know, he's been over at our house, 
and we're friends, we're close. So -- 

Q And there's been -- 

A "Hey, I'm doing this deposition this week," and him being like, "Good luck," 
like, "better you than me" kind of stuff. You know. Good friend kind of stuff. 

Q_ No, I! understand. 

Was that a group chat that you guys had, or did you individually send the article to 
all four of them? 

A Individually. Yeah, it was individual. 


Q Okay. And is there -- 


> 


| don't really like group chats. 

Q_I'msorry? 

A | don't like group chats, so | don't use group chats. 
Q_ No, that's a fair complaint. 


Is there anyone else from Salesforce that contacted you after you left, other than 


pg 


24 


25 


> 


85 


| 

And when did - J? 
Yes, 

And when did he contact you? 
Am | allowed to check my phone? 
Sure. 


So he messaged me on Instagram asking to have a conversation, 


so -- January 7, 2022 -- no, I'm sorry. Whereisit? January 3rd. He said, "Hey 


stranger. 


Happy New Year. You available this week to chat for afew moments? | 


want to run something by you." Do you want me to read the whole thing? 


Q 


A 


Q 
A 


This is, I'm sorry, January 3, 2022? 

That's correct. 

So 4-months-ago-ish? 

Yes. 

Okay. Yeah, if you could read it, that'd be great. 


Okay. 


| said, "Hey! Happy New Year. It's so good to hear from you. ‘I'm available. 


How much time do you need? My best open blocks of time are Thursday and Friday." 


“Early Friday afternoon, say, 1:30 eastern." 


| said, "You hit on my one meeting on Friday. | can do any time after 2:30 


though." 


[Reporter requests clarification.] 


[Discussion off the record. ] 


The Witness. Let's do a comfort break, if you don't mind. 


Ms. Yep. I'll tell youwhat. Soit's 12:23. How about we come back at 
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12:28, 5 minutes? 

The Witness. Yeah, that's perfect. 

Ms. a. Okay. 

What? 

Okay. 12:30. Very reasonable roundup. So we'll take a comfort break -- it's a 
little longer for us, because logistically. So we'll take a comfort break until 12:30, and 
we'll come back on the record and be back from recess then. 

The Witness. Okay. Thank you. 

Wi Thanks. 

[Recess. ] 

Ms. Okay. So we will come back from recess and go back on the record 
at 12:36 p.m. 


BY ms. i: 


Q_ And just before the recess, we were talking about a call that a 
and you had, | believe in January 2022, after you had left Salesforce. 

A Yes, that's correct. 

Q Andcan you tell me, what did you talk about during that call? Or what was 
the purpose of him reaching out to you? 

A So he reached out to offer me: job. He basically said, "I've seen 
your posts on LinkedIn. | know how mentally happy and healthy you are at the new job. 
Would you ever consider coming back and taking ll job?" | don't know if he said 
i: job," but it was heavily implied that it would be Ts job. "Would you 
ever consider coming back?" To which|I said, "No, thank you. I'm good." 

Q_ Anddid you give him any reason why you didn't want to come back? 


A | basically said, like, I'm too happy here. | don't want to deal with it 
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anymore. Like, it's -- I'm done with it for now. 

Q Did you have any conversation about the problems that you had at 
Salesforce? 

A No. |mean, at that point, it was so clear that Salesforce didn't care, that 
saying it wouldn't have mattered. It would've been burning a bridge kind of 
unnecessarily. 

Q Uh-huh. 

A So | just didn't bother. And| was so burnt out at the time, like, nothing 
mattered in that conversation. Like, | could tell you till | was blue in the face that 
Salesforce doesn't care and needs to care, and it wouldn't have mattered. 

Q_ And just out of curiosity, at the beginning of that, you said something along 
the lines of, he said something like, | can tell how mentally and emotionally happy you are 
where you are now? 

A Yes. | mean, | posted that on LinkedIn, that | had previously been 
super-burned-out, and | was at a new company and that | was so much happier and how 
great my new role was and how wonderfully | was doing. Sol had made it public that | 
was thrilled with my new role. 

Q And just out of curiosity, it sounds like -- well, let me rephrase this, because | 
don't want to make an assumption. 

A Sure. 

Q- To the extent that you know or got an impression from him, did you get the 
impression that his knowledge of your past unhappiness was solely from your social 
media comments to that fact, or do you think he knew while you were at Salesforce how 
unhappy you were? 


A That's a good question. He knew towards the end, because | wasn't shy 
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about it. 

Q Can you explain what you mean, that you weren't shy about it? 

A | can. 

So, when | submitted my 2 weeks, he had reached out to me in that timeframe to 
talk. And | explained that | had issues with everything with Salesforce, that | had issues 
with how | AS treating me and had treated me the whole time, with -- being a 

el in tech is hard, but being 7 in tech where the guy above you has 20 years 
of experience and is treating you like his kid is even harder. My experiences there 

just -- | told him everything about why | was so unhappy and why | was leaving. And 
that was in my last 2 weeks. So he knew | was not happy. 

So, to him, though, he thought, okay, well, if | i fi -- | fo. 
might come back, and then we could have, like, a clean slate, everything could be 
hunky-dory, whatever. 

Q_ And what -- 

A But that was not -- 

Q - Oh,sorry. | didn't mean to cut you off. What did you say? 

A But that was not the case. 

Q During the last 2 weeks at Salesforce, when you had the conversations with 

ae... kind of got real with him, did you have any conversations about the lack 
of culture surrounding abuse and compliance? 

A Oh, most definitely. | probably would've said, "And it's clear Salesforce 
doesn't care about my team." 

Q Do you remember anything that he would've said in response to those 
concerns? 


A | don't. He certainly didn't argue that, yes, they do. 


24 


25 


89 


Q  Doyou remember, did you have any discussions with him -- during that 
last-2-week period when you were talking with him about your concerns/feelings, did you 
talk with him at all about what happened with the RNC or the concerns that you voiced 
regarding that case? 

A | don't believe so, no. It was more focused on, like, my feelings, my 
burnout, my experience. | don't think | brought up anything specific to any client. 

And | had similar conversations with also, just in terms of my feelings 
and emotions, et cetera. 

Q Was this a standard exit interview, that you would talk to your supervisor's 
supervisor and supervisor, like, two and three levels up from you? 

A | don't think it's standard. Are =i towards the end -- | would say, towards 
the end -- let's see. Would've been July-ish onward -- or, sorry. Probably would've 
been April to August, was -- well, he was amentor. So we had a couple meetings 
just mentoring corporate -- mentoring, um -- what is it? Like, corporate mentoring 
meetings, basically, leadership kind of mentor-y stuff. 

So | think might've done that as part of the mentor relationship, but | didn't 
get the impression it was standard. 

Q_ This was April to August 2021? 

A Yes. 

Q Okay. And that was just part of some standard program that you and he 
were in? 

A | was in a leadership program where they were training me to become a 
leader of leaders, so it would've been a director level. 

Q Uh-huh. 


A And | reached out -- | was trying to be mentored and, like, become 


24 


25 


90 


something more at Salesforce, become a leader. And sol had that mentoring 
relationship with to try and get myself up higher in the company. And you can see 
where -- 

Q Okay. 

A -- that went. 

Q_ Andhas anybody other thon TE 2: Salesforce 
contacted you since you left? 

A Other than the friends? 

Q Outside of your regular -- like, outside of your friendship relationships, has 
anyone contacted you especially about this or about your role in anything that we've 
talked about? 

A No. 

Q Okay. 

I'm going to completely change gears and ask you just a couple of kind of, like, just 
putting a bow on some things. 

A Okay. 

Q Have you ever heard of a company called Campaign Monitor? 

A Yes. 

Q_ That was an enthusiastic "yes." How have you heard of them? 

A 


| just -- | know of them because of the industry. 


Q  Whoare they? 

A They're an email service provider. 

Q Is that like Marketing Cloud? 

A Yes. | think Campaign Monitor is more on the line of Constant Contact, in 


that they -- | think they have a free level. But, yeah, they're an ESP. 
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QA free level? 

A Like, a free tier where you can just sign up for free and send some emails. 
Q Did you know whether the RNC was using them in addition to Salesforce? 
A I'm not sure. 

Q Would that matter in any way to the use of Marketing Cloud? 

A Potentially. They could've been doing what was known as waterfalling. 


So waterfalling is when you take a purchased list, you run it through a cheaper or free 
email service provider -- so you could run it through Mailchimp or somebody -- and that, 
quote/unquote, "cleans" the list of your hard bounces specifically, and then you take it to 
your more expensive email service provider and you go run the list through them. 

And that's very, very hard to know, because | don't have visibility into any other 
infrastructure they're using. 

But we call it "waterfalling," or "list washing" is another term. 

Q Okay. 

And have you ever heard of something called "warming up IP addresses"? 

A | have. 

Q And what is your understanding of what that phrase means? 

A So, when you are on a new -- when you are changing infrastructures or 
otherwise somehow adjusting your sending on a new dedicated IP address, you will send 
a certain quantity of mail to get up to your standard level of sending. 

So let's say you wanted to send -- ultimately you want to send a million emails. 
You're not going to start out sending a million emails on that IP. You need to warm it 
up. So you would start with sending, | don't know, 20,000 the first week. Then you'd 
do 40,000, then 80,000, and then you'd kind of go up from there. 


It takes awhile todo. But you need to warm up that IP so that receiving servers 
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are seeing, oh, okay, this is a new IP sending on behalf of so-and-so, here's what that mail 
looks like. 

And so they -- servers don't like surprises. Because spammers do that, right? 
Spammers will buy an IP, they'll send whatever they're going to send, trash the IP, and 
move on. So, for us, we have to warm up the IP address so we are clearly not spammers 
and you shouldn't treat the mail as spam. 

Q Anda moment ago you said a "dedicated IP." __Is that a special type of IP as 
compared to, say, like, ashared IP? What's the difference in those? 

A Yes. Soa shared IP will be shared with some X number of other customers. 
A dedicated IP is solely your IP. 

Q And would warming up IP addresses be necessary for -- would it make sense 
for a shared IP or only a dedicated? 

A Not -- ona shared IP, not generally. If you did somehow need to warm on 
a shared IP, you probably are sending a quantity of mail that makes more sense to be ona 
dedicated IP. If you're sending more than 200,000 messages a month, you probably 
should be on a dedicated IP, because you just -- there's more benefits to managing your 
own reputation, being the master of your own destiny, et cetera, et cetera. 

Q_ And if somebody was trying to move, let's say, hundreds of thousands but 
possibly millions of email addresses off of Marketing Cloud to a different platform in 
order to warm up IP addresses, would they need to export data and import it to the other 
platform, or could they do that manually? 

A You would -- from what | know of Marketing Cloud, | think you would have 
to export that data to re-import it. 

Now, that also assumes that their list exclusively lives on Marketing Cloud. So 


what you could also do is you could pull it from some other source. 
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But, yes, you would have -- at some point you're going to have to export that data 
to import it elsewhere, yes. 

Q If the list did live on Marketing Cloud and you wanted to move it to another 
platform -- and, to your point, functionally, it would not make sense to manually copy and 
paste emails addresses, so there would be some kind of export -- would there be some 
kind of log file at Salesforce that would show that? 

A There -- | know it was in Pardot. I'm not confident of Marketing Cloud, but 
it should be. And1 think that might be a requirement even for Soft2, but don't quote 
me onthat. But there should be, yes. 

Q Okay. 

And just going back really quickly, just out of curiosity, were you familiar with or 
did you hear that around the time of -- soon after, | want to say January 6th, but 
definitely around the time of the Salesforce action, did you hear news reports that 
Campaign Monitor also shut down -- oh, excuse me, on January 7th that they also issued 
a statement noting that they had suspended self-service accounts associated with the 
Trump campaign? 

A | had heard that, yes. 

Q What isa self-service account? 

A My understanding of that would be accounts that are maybe not high 
enough to have, like, a dedicated web, is my guess. "Self-service" implies that, like, you 
don't have dedicated resources from the company. But | -- that wasn't my 
infrastructure, so I'm not confident. 

Q No. And|Ithink earlier you said something along the lines of Campaign 
Monitor might have, like, a free service, like, something -- is it possible that's the 


self-service account? 
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A It's possible. Given the RNC's money and how much mail they had and how 
much mail they sent, it would surprise me if they could even stay on a free tier, because 
free tiers wouldn't let you send that kind of quantity of mail. So that's kind of weird to 
me. I'm not sure what that's about. They could've been testing on Campaign Monitor 
maybe. 

Q  Soletme--sorry. | want to make clear, at least the public reporting that | 
was talking about -- 

A Uh-huh. 

Q_ --the statement that they had shut it down noted that they had suspended 
the self-service accounts associated with the Trump campaign, not the RNC. 

A Oh. Okay. 

Q Yeah. Sol didn't want to create confusion and make you think, like, that 
those were different. 

Just out of curiosity, do you remember anyone at Salesforce ever having 
conversations about something called the Make America Great Again Committee? 

A No. 

Q Have you ever heard the term "joint fundraising committee"? 

A Yes. 

Q = Do you know what that is? 

A | do not. 

Q Okay. 

And, sitting here today, did you have any reason to know that the RNC email 
account at Salesforce was being used to send out emails on behalf of a joint fundraising 
committee between the RNC and the Trump campaign called the Make America Great 


Again Committee? 
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A The "Make America Great Again Committee" rings a super-huge bell, but | 
don't know if it's because I've seen it publicly or if I've seen it on the back end. So -- 

Q_ Andall|'m trying to -- 

A -- I'm not sure. 

Q | don't want to put thoughts in your head -- | mean, it's difficult not to, just 
because of the nature of how we ask questions. And I'm really trying to get from you 
what you knew at the time. 

So what I'm trying to figure out is: At least for you, everything that you knew 
from Salesforce suggested that it was the RNC's account. The only way you would've 
known that it was on behalf of the Trump campaign was when you saw the content of 
who it looked like it was on behalf of? 

A __ That's correct. 

Q Okay. 

Ms... Does anybody online have any questions? 

Okay. 

So we have not been able to receive -- as you mentioned earlier, you became 
aware of the publicly reported request to Salesforce and the publicly reported litigation. 
We haven't been able to receive records -- obviously, that's been publicly 
reported -- about the litigation. 

So there may be records that come in in the future from Salesforce that would 
benefit from your examination and testimony. If the committee obtains those records, 
do you have any objection to returning to answer additional questions? 

The Witness. No. | would actually welcome that. As said, everything | do is 
in writing, so it would be good to have that context. Because, again, everything I'm 


telling you is from memory, and memory can be fickle, so | would love to have that stuff 
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in writing. 

Ms. And we appreciate that and your commitment to attention to detail 
and trying to be as specific and as clear as possible, which really makes -- it's very 
appreciated. 

The Witness. Okay. 

Ms. ae. So that will conclude the deposition, and we will stand in recess, 
subject to recall by the chair. 

[Whereupon, at 12:51 p.m., the deposition was recessed, subject to the call of the 


chair.] 
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